When Your Security Scanner Becomes the Weapon: Lessons from the Trivy Supply Cha

<p>In May 2026, a worm called Shai-Hulud compromised 42 TanStack packages — including <code>@tanstack/react-router</code>, a library sitting in millions of JavaScript projects. It

<h1> MCP Security Vulnerabilities in 2026: What Every Agent Developer Must Know </h1> <p>The Model Context Protocol (MCP) has become the universal "USB-C port for AI applications"

<p>Bitwarden serves over 10 million users and 50,000 businesses. On April 22, 2026, for exactly 93 minutes, its CLI was shipping malware.</p> <p>This was not a phishing campaign.

<h2> TL;DR </h2> <ul> <li>AI assistants trained on public repos reproduce hardcoded secrets because that's what they learned</li> <li>A pushed API key is effectively public even

<h2> Introduction and Background </h2> <p>The Rust ecosystem, celebrated for its memory safety and performance, relies heavily on <strong>crates</strong>—its package management

<p>Three incidents landed in five days this week. Different attack surfaces, different techniques, different threat actors. What they have in common is that none of them required

<p>Last week, Apple removed "Anything" from the App Store. The startup had raised $11M at a $100M valuation. Gone overnight.</p> <p>Replit and Vibecode are also blocked from

<p>I've been writing software professionally since 2011.</p> <p>Java, C#, Kotlin, Node.js. Enterprise backends, microservices, APIs, data pipelines. I've shipped production code