Lockhound

@eFawzanNov 4

Commands for all of this (curl + jq, no product needed): lockhound.app/guides/priorit… We automate it across GitHub repos at lockhound.app. Try a lockfile at lockhound.app/check.

Prioritise vulnerabilities with CISA KEV and EPSS · Lockhound

CVSS says how bad a vulnerability could be, not whether anyone exploits it. Add CISA's KEV catalog and EPSS scores to your triage, with commands to run today.

Fawzan · Nov 4, 2026 · 2:40 PM UTC

Lockhound retweeted

@eFawzanNov 4

CVSS = how bad it could be. CISA KEV = attackers are using it now. FIRST EPSS = how likely it is to be exploited soon. You want all three.

Fawzan · Nov 4, 2026 · 2:40 PM UTC

Lockhound retweeted

@eFawzanNov 4

`npm audit` on an old project: 87 vulnerabilities. How many matter this week? Usually a handful. Here's how to find them 🧵

Fawzan · Nov 3, 2026 · 1:10 PM UTC

Lockhound retweeted

@eFawzanNov 3

Not sure what your vibe-coded app actually installed? Paste your package-lock.json, pnpm-lock.yaml or composer.lock at lockhound.app/check. No sign-up, nothing stored. You get what to fix first, not a wall of 87 warnings.

Fawzan · Nov 3, 2026 · 8:30 AM UTC

Lockhound retweeted

@eFawzanNov 3

Top 2 dependency vulnerabilities to fix (Nov 3): 1. @sd-jwt/core (npm): high, fix 0.20.0 2. @bytebase/dbhub (npm): medium, fix 0.22.6 lockhound.app/daily/2026-11-…

Dependency vulnerabilities to fix, Nov 3, 2026 · Lockhound

@sd-jwt/core, @bytebase/dbhub: the dependency vulnerabilities most worth fixing on Nov 3, 2026, ranked by exploitation, severity and reach.

Fawzan · Nov 2, 2026 · 5:38 AM UTC

Lockhound retweeted

@eFawzanNov 2

Your AI agent installs packages you've never heard of. Today every paid plan of Lockhound plugs into Claude Code, Cursor, Copilot and Codex, and checks each package for known vulnerabilities and malware before it's installed. lockhound.app

Lockhound: dependency vulnerability monitoring for GitHub

Find the vulnerable, exploited and malicious dependencies in every GitHub repository, ranked by what to fix first, with a check on every pull request.

133

Fawzan · Nov 1, 2026 · 5:44 PM UTC

Lockhound retweeted

PolinRider hasn't stopped spreading. We investigated the malware campaign at Lockhound and found: • 303 infected GitHub repos missing from public lists • 101 still infected and active in October • A newer variant that hides malicious changes inside existing commits The scary part? Your Git history can look completely normal. Full research + how to check your repos: lockhound.app/guides/polinri…

PolinRider worm: 303 infected repos not on the lists · Lockhound

We found 303 PolinRider-infected GitHub repos missing from the public lists, 101 active in October 2026, and a new variant of how the worm hides commits.

Fawzan · Nov 1, 2026 · 2:15 PM UTC

Lockhound retweeted

Lockhound flags exploited and malicious packages in your composer.lock and package-lock.json, and blocks PRs that add them. Try it on any public repo, no sign-up: lockhound.app/check

Check a lockfile for vulnerabilities, free · Lockhound

Upload package-lock.json, composer.lock, yarn.lock, pnpm-lock.yaml or poetry.lock and see which vulnerable packages to fix first. No sign-up, nothing stored.

Fawzan · Nov 1, 2026 · 11:55 AM UTC

Lockhound retweeted

New: paste any public GitHub repo and see which dependencies to fix first. Exploited, malicious, or just critical, ranked. No sign-up, nothing to install, nothing stored but the report. lockhound.app/check

Check a lockfile for vulnerabilities, free · Lockhound

Upload package-lock.json, composer.lock, yarn.lock, pnpm-lock.yaml or poetry.lock and see which vulnerable packages to fix first. No sign-up, nothing stored.

Fawzan · Nov 1, 2026 · 9:11 AM UTC

Lockhound retweeted

No high-impact dependency advisories today (Nov 1). lockhound.app/daily/2026-11-…

Dependency vulnerabilities to fix, Nov 1, 2026 · Lockhound

The dependency vulnerabilities most worth fixing on Nov 1, 2026, ranked by exploitation, severity and reach.

Fawzan · Oct 30, 2026 · 6:23 PM UTC

Lockhound retweeted

@eFawzanOct 30

Your AI agent installs packages you've never heard of. Lockhound now works with Claude Code, Cursor, Copilot, and Codex to check packages for known vulnerabilities and malware before they're installed. Available on all paid plans. lockhound.app

Lockhound: dependency vulnerability monitoring for GitHub

Find the vulnerable, exploited and malicious dependencies in every GitHub repository, ranked by what to fix first, with a check on every pull request.