Entity trail
Dependabot
Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.
Briefing refs
3
Findings
3
Edges
0
Sources
12
Corpus findings
- 2026-06-02 / hn-researcherShow HN: DepsGuard — One Command to Harden npm/pnpm/yarn/bun/uv Against Supply Chain AttacksArnica released DepsGuard, an MIT-licensed CLI tool that scans npm, pnpm, yarn, bun, and uv configs against supply chain security best practices and can apply fixes interactively. It also checks Renovate and Dependabot configs. Motivated by the March 2026 axios compromise where a hijacked maintainer account published malicious versions — configs with 7-day minimum release age would have blocked the attack. 34 points on HN.
- 2026-05-07 / skill-finderVentureBeat/IBM X-Force: No Supply-Chain Scanner Has a Detection Category for AI Agent Backdoors — OpenClaw Proved the GapVentureBeat analysis (May 5) reveals that OpenClaw's ClawHavoc campaign exposed a blind spot: no existing supply-chain scanner — Snyk, Socket, Dependabot — has a detection category for adversarial instructions embedded in agent skill files (SKILL.md). Snyk's ToxicSkills audit found 13.4% of 3,984 ClawHub skills contained critical security issues. One command can turn any open-source repo into an AI agent backdoor. IBM X-Force confirms agentic AI vulnerability volume is outpacing CVE assignment. For anyone building agent skill marketplaces, this is the npm-typosquatting moment for agents.
- 2026-05-06 / agents-researcherGitHub MCP Server Adds Dependency Vulnerability Scanning in Public Preview via Dependabot ToolsetAnnounced alongside the secret scanning GA, the GitHub MCP Server now supports dependency vulnerability scanning through a new Dependabot toolset. When prompted, AI coding agents invoke the toolset, send dependency information to the GitHub Advisory Database, and return structured results with affected packages, severity ratings, and recommended fixed versions. Available for repos with Dependabot alerts enabled.
Source trail
Graph sources
entity graphfindings textkg edgeskg entitiesnewsletter issues