Toni Antunovic

Jun 25

GitHub Is Becoming a Giant AI Code Dump. Quality Gates Are the Only Fix.

#vibecoding #codequality #qualitygates #github

Nation-State Actors Are Now Targeting Your AI Agent's npm Packages

6 min read

Want to connect with Toni Antunovic?

Create an account to connect with Toni Antunovic. You can also sign in below to proceed if you already have an account.

Create Account

Already have an account? Sign in

Jun 25

Nation-State Actors Are Now Targeting Your AI Agent's npm Packages

#security #npm #ai #devsecops

10,000 Malicious GitHub Repos: Why AI Dependency Suggestions Are Now a Security Risk

6 min read

Jun 20

10,000 Malicious GitHub Repos: Why AI Dependency Suggestions Are Now a Security Risk

#security #webdev #devops #ai

2 reactions

One "Fix This Code" Prompt Away from a Production Incident

6 min read

Jun 18

One "Fix This Code" Prompt Away from a Production Incident

#aicodereview #productionsecurity #qualitygates #devsecops

How Context Window Rot Degrades AI Code Quality Over Long Sessions

7 min read

Jun 16

How Context Window Rot Degrades AI Code Quality Over Long Sessions

#claudecode #aitools #qualitygates #aigenerated

How to Set Up Automated Quality Gates for Claude Code with MCP

6 min read

Jun 16

How to Set Up Automated Quality Gates for Claude Code with MCP

#claudecode #qualitygates #mcp #aitools

Miasma Worm: How Opening a Repo in Claude Code Became a Credential Theft Vector

7 min read

Jun 11

Miasma Worm: How Opening a Repo in Claude Code Became a Credential Theft Vector

#security #supplychainsecurity #claudecode #devsecops

The Gemini CLI CVSS 10 Attack: How a GitHub Issue Became a Supply Chain Weapon

9 min read

Jun 9

The Gemini CLI CVSS 10 Attack: How a GitHub Issue Became a Supply Chain Weapon

#security #promptinjection #supplychainsecurity #devsecops

The Maintainer Trap: What the jqwik Incident Reveals About Trusting Your Dependencies

6 min read

Jun 7

The Maintainer Trap: What the jqwik Incident Reveals About Trusting Your Dependencies

#security #supplychain #agentic #devops

Claude Code Has a Remote Instruction Channel. Here Is What That Means for Your Workflow.

6 min read

May 30

Claude Code Has a Remote Instruction Channel. Here Is What That Means for Your Workflow.

#security #claudecode #mcp #aicoding

The NSA Just Weighed In on MCP Security: What It Means for Your AI Coding Workflow

6 min read

May 28

The NSA Just Weighed In on MCP Security: What It Means for Your AI Coding Workflow

#security #mcp #ai #devops

Constraint Decay: Why Your AI Coding Agent Passes Tests But Breaks Production

6 min read

May 28

Constraint Decay: Why Your AI Coding Agent Passes Tests But Breaks Production

#ai #codequality #webdev #programming

Transitive Prompt Injection in Multi-Agent Coding Pipelines: One Poisoned Tool, Every Downstream Agent

9 min read

May 23

Transitive Prompt Injection in Multi-Agent Coding Pipelines: One Poisoned Tool, Every Downstream Agent

#promptinjection #multiagentai #agenticsecurity #claudecode

Slopsquatting: The Attacker Playbook for AI-Hallucinated Package Names

9 min read

May 21

Slopsquatting: The Attacker Playbook for AI-Hallucinated Package Names

#slopsquatting #supplychainsecurity #aicodingagents #npmsecurity

When Every PR Is a Rubber Stamp: What Automated Gates Catch That Exhausted Reviewers Miss

10 min read

May 19

When Every PR Is a Rubber Stamp: What Automated Gates Catch That Exhausted Reviewers Miss

#codereview #devsecops #aitools #productivity

Clinejection: When Your AI Coding Tool Became the Weapon

8 min read

May 16

Clinejection: When Your AI Coding Tool Became the Weapon

#promptinjection #supplychainsecurity #devsecops #githubactions

9 min read

CLAUDE.md Is a Security Boundary

May 14

CLAUDE.md Is a Security Boundary

#security #claudecode #devsecops #configsecurity

2 reactions

What LucidShark Would Have Caught Before the TanStack Attack Landed

7 min read

May 14

What LucidShark Would Have Caught Before the TanStack Attack Landed

#supplychainsecurity #sca #tanstack #devsecops

Approve Once, Exploit Forever: The Trust Persistence Vulnerability Vendors Will Not Fix

7 min read

May 12

Approve Once, Exploit Forever: The Trust Persistence Vulnerability Vendors Will Not Fix

#security #claudecode #devsecops #supplychain

How to Review Code Your AI Agent Wrote While You Were Sleeping

6 min read

May 12

How to Review Code Your AI Agent Wrote While You Were Sleeping

#aiagents #codereview #devsecops #codequality

The Georgia Tech CVE Data Shows AI Code Tools Have a Volume Problem

7 min read

May 7

The Georgia Tech CVE Data Shows AI Code Tools Have a Volume Problem

#security #webdev #ai #programming

The Co-Authored-By Copilot Controversy Misses the Real Problem

7 min read

May 5

The Co-Authored-By Copilot Controversy Misses the Real Problem

#aicodereview #githubcopilot #codequality #sast

CVE-2026-26268: How Cloning a Repo Can Now Execute Attacker Code in Your AI IDE

6 min read

May 2

CVE-2026-26268: How Cloning a Repo Can Now Execute Attacker Code in Your AI IDE

#security #cursor #git #devsecops

10 reactions

The MCP RCE That Anthropic Won't Patch: Your Enforcement Checklist

6 min read

Apr 30

The MCP RCE That Anthropic Won't Patch: Your Enforcement Checklist

#security #mcp #devops #agentic

2 reactions

572K Weekly Downloads, One Preinstall Script: The SAP CAP Supply Chain Attack Your AI Agent Would Have Missed

6 min read

Apr 29

572K Weekly Downloads, One Preinstall Script: The SAP CAP Supply Chain Attack Your AI Agent Would Have Missed

#security #npm #supplychain #devops

When Your AI Coding Tool Disappears Overnight: The Case for Provider-Agnostic Quality Gates

3 min read

Apr 28

When Your AI Coding Tool Disappears Overnight: The Case for Provider-Agnostic Quality Gates

#claudecode #devtools #aicode #qualitygate

AI Hallucinated Dependencies Are the New Supply Chain Attack: How to Stop Them

6 min read

Apr 28

AI Hallucinated Dependencies Are the New Supply Chain Attack: How to Stop Them

#supplychainsecurity #aicode #npm #security

AI Agents Generate Code That Passes Your Tests. That Is the Problem.

8 min read

Project Glasswing Found 35 CVEs in March. Here Is the Quality Gate You Need Before AI Agents Touch Your Codebase.

Apr 18

AI Agents Generate Code That Passes Your Tests. That Is the Problem.

#testing #ai #codequality #devops

9 reactions

6 comments

6 min read

Apr 16

Project Glasswing Found 35 CVEs in March. Here Is the Quality Gate You Need Before AI Agents Touch Your Codebase.

#security #devsecops #ai #sast

When a Git Branch Name Becomes a Weapon: The Codex Command Injection That Could Steal Your GitHub Token

7 min read

Apr 11

When a Git Branch Name Becomes a Weapon: The Codex Command Injection That Could Steal Your GitHub Token

#security #github #devsecops #claudecode

OWASP Top 10 for Agentic Applications 2026: What Every Claude Code User Needs to Know

6 min read

When Your Security Scanner Becomes the Weapon: Lessons from the Trivy Supply Chain Attack

Apr 11

OWASP Top 10 for Agentic Applications 2026: What Every Claude Code User Needs to Know

#owasp #security #claudecode #devsecops

3 reactions

2 comments

11 min read

Apr 7

When Your Security Scanner Becomes the Weapon: Lessons from the Trivy Supply Chain Attack

#security #devops #github #devsecops

npm Provenance and SLSA: The Supply Chain Hygiene Baseline Every Team Needs in 2026

2 min read

Apr 4

npm Provenance and SLSA: The Supply Chain Hygiene Baseline Every Team Needs in 2026

#security #npm #devops #javascript

MCP Connector Poisoning: How Compromised npm Packages Hijack Your AI Agent

5 min read

SAST False Positives in AI-Generated Code: Why 91% of Alerts Are Noise (And How to Fix It)

Apr 4

MCP Connector Poisoning: How Compromised npm Packages Hijack Your AI Agent

#security #npm #javascript #devops

2 comments

5 min read

Mar 31

SAST False Positives in AI-Generated Code: Why 91% of Alerts Are Noise (And How to Fix It)

#sast #security #ai #codequality

The Hidden Cost of Code Duplication in AI-Assisted Development

8 min read

Mar 27

The Hidden Cost of Code Duplication in AI-Assisted Development

#webdev #ai

Prompt Injection in AI Coding Agents: How Malicious Dependencies Hijack Your Claude Code Sessions

7 min read

Mar 27

Prompt Injection in AI Coding Agents: How Malicious Dependencies Hijack Your Claude Code Sessions

#security #claudecode #ai

RSAC 2026: Every AI IDE Is Vulnerable - Here's What That Actually Means for Your Workflow

8 min read

Mar 27

RSAC 2026: Every AI IDE Is Vulnerable - Here's What That Actually Means for Your Workflow

#security #ai

AI Code Review Tools Compared: What Actually Catches Bugs in AI-Generated Code?

6 min read

Mar 24

AI Code Review Tools Compared: What Actually Catches Bugs in AI-Generated Code?

#security #ai #devtools #programming

Local-First Code Quality for Claude Code: How to Catch Bugs Before They Leave Your Machine

8 min read

Mar 24

Local-First Code Quality for Claude Code: How to Catch Bugs Before They Leave Your Machine

#security #ai #devtools #productivity

The Claude Code CVE That Should Change How You Review AI-Generated Code

8 min read

Mar 23

The Claude Code CVE That Should Change How You Review AI-Generated Code

#security #ai #devtools #webdev

A post-mortem on the fastest database breach of 2026 - and the quality gate that would have stopped it cold.

5 min read

Mar 22

A post-mortem on the fastest database breach of 2026 - and the quality gate that would have stopped it cold.

#ai #codequality #database #security

The Vibe Coding Security Checklist: 10 Checks to Run Before You Ship AI-Generated Code

5 min read

Mar 16

The Vibe Coding Security Checklist: 10 Checks to Run Before You Ship AI-Generated Code

#vibecodingsecurity #ai #bestpractices #programming

10 min read

AI Writes Code. But Who Checks It?

Mar 13

AI Writes Code. But Who Checks It?

#ai #programming #opensource #devtools

Running code quality pipelines during AI coding workflows

3 min read

Mar 12

Running code quality pipelines during AI coding workflows

#sonar #security #snyk #code

6 reactions