Endor Labs Blog
endorlabs.com · Company blog · on HN since 2022
Endor Labs, an application security company, publishes research on supply chain attacks, CVEs and the security of AI-generated code.
What HN saysHN links it for npm and PyPI compromise analyses, protobuf flaws and an AI code security benchmark, where commenters dispute one model's ranking and cost.
16HN people shared it
6linked it in comments
18stories submitted
30story points
2 months agolast shared
2022people per year2026
Most-shared posts
- 1AI Coding Agents get better at functional code, but not security3 people · 1 points · first shared 2026 · discussion on HN
- 2Critical RCE Vulnerability in Apache Parquet/CVE-2025-300652 people · 5 points · first shared 2025 · discussion on HN
- 3Mastra compromised in supply chain attack1 people · 3 points · first shared 2026 · 2 comments on HN
- 4Eslint-config-prettier Compromise1 people · 3 points · first shared 2025 · discussion on HN
- 5Analyzing a NPM Spam Campaign: The Great Indonesian Tea Theft1 people · 2 points · first shared 2025 · discussion on HN
- 6CVE-2026-22709: Critical Sandbox Escape in Vm2 Enables Arbitrary Code Execution1 people · 2 points · first shared 2026 · discussion on HN
- 7How to quickly measure SBOM accuracy for Maven projects using sbom-lab1 people · 2 points · first shared 2023 · 1 comments on HN
- 8Claude Fable 5: mid-tier results on coding tasks1 people · 2 points · first shared 2026 · discussion on HN
- 922x memory amp DoS in Anthropic's buffa protobuf decoder (CVE-2026-55407)1 people · 2 points · first shared 2026 · discussion on HN
- 10Endor Labs Software Supply Chain Security1 people · 1 points · first shared 2022 · discussion on HN
- 11Hacking your life with AI can get you hacked – Research1 people · 1 points · first shared 2026 · discussion on HN
- 12Please add min-release-age to your .npmrc1 people · 1 points · first shared 2026 · 1 comments on HN
- 13Selection based on OSS package scores1 people · 1 points · first shared 2024 · discussion on HN
- 14The Dangers of Reusing Protobuf Definitions: Critical Code Exec in Protobuf.js1 people · 1 points · first shared 2026 · discussion on HN
- 15How to Defend Against NPM Software Supply Chain Attacks1 people · 1 points · first shared 2025 · discussion on HN
What HN people wrote when they linked it
ChrisArchitect · 2025-11-15
Related:
Analyzing a NPM Spam Campaign: The Great Indonesian Tea Theft https://www.endorlabs.com/learn/the-great-indonesian-tea-theft-analyzi…
(https://news.ycombinator.com/item?id=45919514)
Supermancho · 2026-06-15
> I found my interactions with Fable to be extremely impressive; it made other models, including GPT 5.5 and Opus 4.8, feel small and dumb.
> Anthropic models have consistently been top-scoring in BullshitBench[0]
eyeroll I find that Anthropic models feel big and dumber.
https://www.endorlabs.com/research/ai-code-security-benchmark puts Fable 5th, which seems about right to me.
I'm interested in code utility and correctness, even if the majority of AI use is not focused on that.
ewok94301 · 2026-06-11
Actually its average because it's 5th on the leaderboard. GPT 5.5 and Opus 4.8 outperformed it. At 5-8x the cost, you would expect better! https://www.endorlabs.com/research/ai-code-security-benchmark
gnabgib · 2026-04-19
Lots more details from Endor labs (flaw finder & source): https://www.endorlabs.com/learn/the-dangers-of-reusing-protobuf-defini…
mrkeen · 2026-03-29
> Why is the LiteLLM incident on there? The linked article for that one is a 404.
-> [Endor Labs] https://www.endorlabs.com/learn/teampcp-isnt-done
-> On March 24, 2026, Endor Labs identified that litellm versions 1.82.7 and 1.82.8 on PyPI contain malicious code not present in the upstream GitHub repository. litellm is a widely used open source library with over 95 million month downloads. It lets developers route requests across LLM providers through a single API.
natebc · 2025-04-06
https://www.endorlabs.com/learn/critical-rce-vulnerability-in-apache-p…
> Any application or service using Apache Parquet Java library versions 1.15.0 or earlier is believed to be vulnerable (our own data indicates that this was introduced in version 1.8.0; however, current guidance is to review all historical versions). This includes systems that read or import Parquet files using popular big-data frameworks (e.g. Hadoop, Spark, Flink) or custom applications that incorporate the Parquet Java code. If you are unsure whether your software stack uses Parquet, check with your vendors or developers – many data analytics and storage solutions include this library.
Seems safe to assume yes, pandas is probably affected by using this library.