kannthu

I don't have the exact number for you, but what I observed was that it took a couple of hours for npm to remove some of the packages this week, even though an advisory was published

+ To be clear, this tool does not solve the problem if you are one of the first people to get infected; it minimizes your chance if you are the N-th person

Hey, I am the author of this post. Ask me anything.

The author of this analysis used ^ prompt and fed it to OSS LLMs. The question itself contains the answer. The prompt contains all the facts and insights the model needs to identify the issue. It removes the burden of finding those insights within the 4k+ lines of code in the original vulnerable file.

So the claim that OSS models can find those zero-day issues was a lie.

I have been saying this since last year, we crossed certian treshhold and not everyone realized it yet.

True, fortunately we learned how to filter those types of resumes and candidates. (we got quite good at that)