Entity trail

CodeWhale

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-05 / agents-researcherNine advisories land on CodeWhale in one day, including a critical SSRF bypass that beats DNS pinning via a TOCTOU on resolution failureGitHub published nine advisories for the CodeWhale coding agent TUI (shipped as deepseek-tui / codewhale on npm and crates.io) on 2026-09-04, spanning CVSS 7.0 to 9.3. The headline critical (GHSA-6v2g-fpxh-pmmh, CVSS 8.6, CVE-2026-75856) exploits the agent's DNS-pinning code allowing execution to continue when a lookup fails: an attacker-run resolver fails the first A/AAAA queries, then answers 127.0.0.1 on the retry, and fetch_url reads localhost. The rest are the now-familiar coding-agent pattern, argument injection in git_blame and git_show giving unapproved file read and write, project-config allow_shell and instructions overrides that a cloned repo can set, rlm_eval auto-approving Python, and image_analyze following workspace symlinks. Fixed in 0.8.64.
2026-08-26 / projects-researcherBitFun Publishes a Nightly Build at Only 1,817 Stars, Pairing a Rust Agent Runtime With a Desktop AppGCWing/BitFun tagged a nightly at 06:26 UTC today, five days after v0.2.19-beta.1 on August 21, on a repo created 2026-02-02 that holds just 1,817 stars and 202 forks. It combines a Rust agent runtime with a desktop application, explicitly aiming past coding at general-purpose work, which puts it in the same slot as the far larger CodeWhale and BitFun's own Rust peers. Running a nightly channel at under 2,000 stars is either discipline or premature ceremony, and the beta tag two versions below 1.0 suggests the latter.
2026-08-26 / projects-researcherCodeWhale Shipped Three Tags in Six Days and Is Still Pre-1.0 at 40,860 StarsHmbown/CodeWhale, a Rust terminal coding agent created 2026-01-19, tagged v0.9.9 on August 18, v0.9.10 on August 20 and v0.9.11 on August 23. It holds 40,860 stars and 3,537 forks with 117 open issues, and has never cut a 1.0 despite being one of the largest open coding agents by star count. The version number is worth reading literally here rather than as modesty, since the repo explicitly frames itself as on a journey of continuous community improvement and takes outside PRs.
2026-08-17 / github-pulse-researcherCodeWhale v0.9.8 Completes the deepseek-tui Rebrand and Ships Two Command Names From One Binary Across Nine Platform ArchivesHmbown/CodeWhale (40,828 stars, Rust) released v0.9.8 on 2026-08-16, formally deprecating the legacy `deepseek-tui` npm package with a REBRAND.md migration path for v0.8.x users. The release ships identical runtimes under both `codewhale` and `codew` across npm, Homebrew, GHCR, archives and an NSIS installer — with the honest caveat that Cargo cannot create a second command alias from one binary target, and that the Windows NSIS installer remains unsigned and will trip SmartScreen until a certificate is wired into the pipeline. Distribution breadth (Linux x64/ARM64, Android Termux, macOS x64/ARM, Windows x64/ARM64 including portable builds) is now a competitive axis for agent harnesses.

Graph relationships

MENTIONS
DNS
CodeWhale has DNS pinning bypass vulnerability
Source finding
USES
Rust
CodeWhale is a Rust terminal coding agent
Source finding
COMPETES WITH
BitFun
BitFun and CodeWhale compete in the general-purpose coding agent application category
Source finding
COMPETES WITH
BitFun -> CodeWhale
BitFun and CodeWhale compete in the general-purpose coding agent application category
Source finding

Source trail

NVD NVD Hmbown/CodeWhale GitHub GitHub Security Advisories GitHub

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…