cyber.hendryadrian.com
Security Insights · aikido.dev

How Aikido Intel Detects Open-Source Malware and Vulnerabilities

· Original article ↗

Summary

Aikido describes Intel’s package-monitoring pipeline, which combines static rules, sandbox analysis, AI and researcher review to flag malware, and tracks project changes to identify potential undisclosed vulnerabilities.

Key points

  • Aikido says Intel continuously monitors more than four million packages across open-source ecosystems and analyzes new releases within minutes.
  • The malware pipeline extracts and deobfuscates packages, then applies researcher-written static rules and, for npm packages, sandbox analysis.
  • Aikido says AI connects signals across files to assess harder cases, with security researchers reviewing cases that automation cannot resolve.
  • The company reports that in Q2 2026 Intel analyzed about 7.5 million package versions and confirmed 19,500 malicious packages; it says the median detection time is under six minutes.
  • Intel’s vulnerability track examines project changes for potential security fixes, including issues without public disclosures or CVEs, and may publish an Aikido Vulnerability ID and severity score.
  • Aikido recommends delaying adoption of new package releases for a day or two; it says Safe Chain can block confirmed malware and npm packages less than 24 hours old.

Article Details

Topic
Aikido Intel’s real-time detection of malware and undisclosed vulnerabilities in open-source ecosystems

People

Charlie EriksenAikido’s lead security researcher; he validated and published a list of infected npm packages during the second wave of the Shai-Hulud campaign.

Malware

Shai-Huludcredentials through a poisoned GitHub Action, we caught it early. We were among the first to report the Shai-Hulud worm that followed. When its more dangerous second wave hit high-profile packages from Zapier, PostHog,

Vendors

AikidoTL;DR: Aikido Intel is a real-time supply chain intelligence feed. It detects both malware and vulnerabilities in open-source ecosystems. Aikido's world-class researchers maintain our LLM-powered pipeline to find

Products

Aikido IntelTL;DR: Aikido Intel is a real-time supply chain intelligence feed. It detects both malware and vulnerabilities in open-source ecosystems. Aikido's world-class researchers maintain our LLM-powered pipeline to findDevice Protectionworry about accidentally getting pwned by installing the wrong package at the wrong time. Aikido’s Device Protection is the enterprise version that protects all developer endpoints across your organization.

Tools

Aikido Safe ChainTo harness the full power of Aikido Intel, consider using Aikido Safe Chain— a free, open source tool you can install to keep you safe from malware downloads. Powered by Aikido Intel, it sits on your computer, besideOpengrepover the package contents. The engine leverages different malware recognition systems, including Opengrep (of which we are lead maintainers) and YARA-X from Google, which is commonly used in classic antivirusYARA-Xdifferent malware recognition systems, including Opengrep (of which we are lead maintainers) and YARA-X from Google, which is commonly used in classic antivirus engines. Our security team writes and maintains

Related Articles