All pull requests

Pull requests

• [Aikido] Fix security issue in @aikidosec/safe-chain via minor version upgrade from 1.0.0 to 1.5.7

  #669·aikido-autofix[bot] opened Oct 9, 2026Bot·

  ·

• [Aikido] Prevent Windows package manager hijacking via path resolution

  #668·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Mitigate npm proxy configuration bypass across package managers

  #667·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Block alternate package registry sources in npm and npx command scanning

  #666·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent external package specification bypass in dependency scanners

  #665·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Enforce registry allowlisting in proxy to prevent package-manager bypass

  #664·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent package specification bypass in npm, pnpm, yarn, npx, and rush scanners

  #663·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent non-registry package bypass in Safe Chain malware gate

  #662·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Reject non-registry package specs to prevent malware scanning bypass

  #661·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Enforce fail-closed package scanning and fix registry matching with port handling

  #660·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Fix npx local package execution bypass in command argument scanner

  #659·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent @npm: alias bypass in package manager parsers across npm, npx, pnpm, rush, and yarn

  #658·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent npm alias bypass in package manager parsers across all managers

  #657·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Fix PEP 440 hyphenated filename parsing in pip package interceptor

  #656·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Fix HTTP proxy bypass vulnerability in Yarn package manager

  #655·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Fix noncanonical npm version bypass in resolvePackageVersion()

  #654·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Fix PATH-injection code execution vulnerability in Windows uninstaller

  #653·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Add HTTP_PROXY to Safe Chain proxy environment variables to prevent package manager bypass

  #652·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent proxy bypass attacks in registryProxy by explicitly setting all proxy environment variables

  #651·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent Yarn install command bypass by rejecting empty package lists

  #650·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent command resolution shadowing attacks in shell integrations

  #649·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Fix remote code execution in Windows installer scripts via unsafe iex-iwr patterns

  #648·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Restrict tag patterns and require approval for production signing credentials

  #646·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·
  2

• [Aikido] Fix TOCTOU vulnerability in MSI verification with protected staging directory

  #647·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·

• [Aikido] Prevent arbitrary code execution in npm uninstall by adding --ignore-scripts flag

  #645·aikido-autofix[bot] opened Oct 8, 2026Bot·

  ·