Replying to @eriktorenberg
Done my research and decided to sign up for it. Thank you for sharing this
Every supply-chain attack affecting the npm ecosystem, the most common apps I find vulnerable are the vibe-coded ones due to lack of version pinning..
If @Cursor and other coding platforms make pinning the default, we'll see less runtime environments affected.
Karim El-Melhaoui retweeted
Shai-Hulud 2.0, a tale of 4 graphs: many numbers have made the news in regards to this story - such as 800 compromised packages - but visualizing the data clearly shows the potential impact of hijacking even a small set of key packages (in terms of prevalence or dependents):
Karim El-Melhaoui retweeted
🚨 New Shai-Hulud-style npm attack hitting 25k+ repos and growing fast.
Devs & CI/CD exposed via malicious preinstall. Wiz Research has detection + mitigation.
Details: wiz.io/blog/shai-hulud-2-0-o…
Replying to @karimscloud @gauravphoenix
Nordnet’s social forum is usually good for nordic stocks: nordnet.no/aksjer/kurser/mel…
Replying to @gauravphoenix
Not an investment analysis but since you mention a Norwegian company: There’s declining interest rates affecting mortgage yield of Norwegian banks, they’ve had a historically good yield. There’s also the competitive landscape with Sparebank 1 SMN which is strong in the region
Karim El-Melhaoui retweeted
The schedule for fwd:cloudsec Europe is out, with a single track of high-quality talks over 2 days, along with “Birds of a Feather” interactive sessions!
fwdcloudsec.org/conference/e…
Some sponsorship opportunities are still available
Great work by the @SpecterOps team adding Entra ID to GitHub attack paths! Will officially archive once I can validate it supports OIDC github.com/O3-Cyber/oidc-cod…
I’m left wondering how many unpaid AWS bills are related to this.
Front row seat on @paulschwarzen session presenting OWASP Domain Protect at @AppSecEU 👏
Reminder that the fwd:cloudsec Europe 2025 Call for Papers is open!
First time speakers who requested feedback by May 30th and meet the submission criteria will receive feedback on how to improve during the second round.
For more: fwdcloudsec.org/conference/e…
What happens if a lambda that puts an event to an S3 triggers on the same S3… I can’t afford to find out
Karim El-Melhaoui retweeted
🏃♂️Meet ImageRunner: A privilege escalation vulnerability I discovered in GCP Cloud Run.
Thank you for the @GoogleVRP team for working closely with us on this one.
*Stay tuned for more blogs to come!
tenable.com/blog/imagerunner…
Replying to @CraigHRowland
Interested in reading your research, where may I find it?













