Dev Tools — page 1 of 4
- Dev Tools6 min
Claude Code Cursor Extension: Version 2.1.312 Was Clean on One Registry and Backdoored on Another
By Petru Popa ·The Hacker News and StepSecurity write-ups of the tampered Claude Code extension center on 2.1.313, a version that never existed upstream and is easy to spot. Cursor's October 30 update added 2.1.312, which did exist upstream, unmodified, under the same publisher, ID and folder name. OVHcloud's CLI hit the same pattern twelve days earlier. Here is what still separates the copies, and the checks to run.
Read - Dev Tools6 min
AI Agent Sandboxing with NVIDIA OpenShell: The Sandbox Holds. The Gateway Can Start Wide Open.
By Petru Popa ·NVIDIA OpenShell is the AI agent sandboxing runtime on the Hacker News front page this week: 1,852 commits, weekly releases, Anthropic and OpenClaw integrations. Its sandbox boundary is sound. Its gateway, read at v0.1.5, injects a platform-admin principal for every caller when no authentication is configured, whatever the opt-in flag says. A fix is open. Here is the maturity picture, the mechanism, and the checklist before a gateway leaves loopback.
Read - Dev Tools6 min
LiteLLM Supply Chain Attack: The Hardened Pipeline Published the Malware
By Petru Popa ·litellm 1.107.0 shipped a credential stealer through LiteLLM's own release workflow, pointed at a lookalike repository. PyPI's integrity API shows the project stopped publishing attestations in April, and even an attestation would have named the same workflow the attacker ran. The one record that told the truth was the Docker build provenance, which nobody checks.
Read - Dev Tools6 min
AI SAST on GitHub: AI Scan Skips the Pull Requests Most Open Source Projects Merge
By Petru Popa ·AI Scan is GitHub's AI-based scanner for the languages CodeQL does not cover: PHP, shell, Terraform, Dockerfiles and more. It went GA on 15 October, opened to public organization repositories without an active-committer licence, and is advisory only. Its docs also say it never runs on fork or Dependabot pull requests. Measured against 1,050 merged pull requests in eight public repositories written in exactly those languages, it would have seen 198, and 179 of those came from one project.
Read - Dev Tools6 min
GitHub Actions Security: What the New Workflow Lockfile Does Not Lock Yet
By Petru Popa ·Workflow lockfiles pin every action a GitHub Actions workflow uses, transitive ones included, to a commit checked again at run time. Read gh-actions-lock v0.2.0 and its issue tracker instead of the changelog and the coverage is narrower than the docs say: remote reusable workflow calls are dropped, Docker images still run by tag, actions inside parallel step groups are skipped, and a broken lockfile is ignored unless a policy is on. What to adopt now, and the three checks to run first.
Read - Dev Tools6 min
llama.cpp in Docker Still Listens on 8080. Everywhere Else It Moved to 9931.
By Petru Popa ·llama.cpp v0.7.0 moved llama-server's default port from 8080 to 9931, while its Docker images pin 8080. Read the pull request, the Dockerfiles and the Hugging Face snippet source next to each other and you find two defaults for one server, a Hugging Face launch post that uses both in the same section, and agent configs on model pages that will point at a dead port as soon as Homebrew ships 0.7.0. The pattern, a second instance from MLX, and the two-line fix.
Read - Dev Tools6 min
Agent Observability for Copilot: The New Capture Controls Are Not One Policy Across Your Clients
By Petru Popa ·Copilot's enterprise managed settings can now switch identity, prompts, responses, tool arguments, tool output and policy detail on separately in exported OpenTelemetry data. Read the docs commit and the VS Code documentation next to the announcement and the picture changes: the old captureContent key now reaches raw commands and tool results, VS Code's local harness still gives you all or nothing, and the two vendors' docs disagree about environment-variable overrides and Agent Host identity. What to change in your rollout plan this quarter.
Read - Dev Tools6 min
Codex CLI Starts a Self-Updating Daemon by Default. The config.toml Switch Is Not in the Docs.
By Petru Popa ·Codex CLI 0.157.0 turned on automatic background-server startup, and the source at 0.162.1 still marks daemon_auto_start as stable and enabled by default. The daemon outlives the terminal, keeps the environment of the session that started it, and runs an updater that checks hourly and stops only when you tell it the right way. OpenAI's config reference does not list the key. Here is what the source says, and the two files that turn it off.
Read - Dev Tools6 min
CodeQL Swift Scanning Has No Supported Setup on Xcode 27. Some Runs Still Pass.
By Petru Popa ·GitHub's CodeQL 2.27.2 notes say traced builds stop working on macOS 27 and with Xcode 27, because Apple no longer ships the Intel slices the tracer needs. The workaround offered is build mode none, which Swift does not have. On the xcode-27 runner, one public Swift scan dies on a Bad CPU type error and another finishes green with no warning at all. The guard that would flag it is still an open pull request.
Read - Dev Tools6 min
GitHub Secret Scanning Got a New AI Model. Its Documented Blind Spots Predate It.
By Petru Popa ·On October 7 GitHub moved every repository with AI-detected password alerts onto a purpose-built secret detection model, and priced push-time checks in AI Credits that are spent whether or not a push is blocked. The only published account of what the detector skips was last edited two weeks before the swap, and a June docs migration had already cut it from five exclusions to one, losing the word that made that one readable.
Read - Dev Tools6 min
GitHub Copilot With Ollama: Going Offline Switches Off Content Exclusion
By Petru Popa ·Copilot CLI now discovers models from a running Ollama instance. GitHub's own docs show that the setting which keeps prompts off GitHub's servers also cuts the CLI off from the content exclusion rules it fetches there, and the CLI changelog says unreachable rules mean files stay readable.
Read - Dev Tools6 min
AI Agent Security After Copilot's Sandbox Went GA: The Default Policy Still Lets Agent Commands Read Your Registry Tokens
By Petru Popa ·GitHub made local sandboxing for Copilot generally available on 7 October. The docs behind the announcement show it ships off, that its default policy grants read access to package-registry tokens while leaving outbound traffic open, and that the CLI's own file tools are checked in software rather than by the operating system.
Read