Mag Solutions

We build a GitHub App that reviews AI-written pull requests. We also measure how often the threat we sell against actually happens, and publish the number either way.

Joined on Sep 9, 2026

Mag Solutions

Oct 19

Field report: 12656 real pull requests scanned, 9.6% flagged, 46 of our own mistakes fixed in public

#security #supplychain #opensource #devops

2 min read

Want to connect with Mag Solutions?

Create an account to connect with Mag Solutions. You can also sign in below to proceed if you already have an account.

Create Account

Already have an account? Sign in

Mag Solutions

Oct 19

items-validator and item-validator: three weeks old and six years dormant, flagged as malware the same morning

#security #javascript #ai

4 min read

Mag Solutions

Oct 12

Field report: 9917 real pull requests scanned, 7.9% flagged, 46 of our own mistakes fixed in public

#security #supplychain #opensource #devops

2 min read

Mag Solutions

Oct 12

How to read a package's install scripts before npm runs them

#javascript #security #ai

4 min read

Mag Solutions

Oct 5

Field report: 6949 real pull requests scanned, 6.1% flagged, 46 of our own mistakes fixed in public

#security #supplychain #opensource #devops

2 min read

Mag Solutions

Oct 5

Six Angular typosquats, one postinstall hook, published the same morning

#security #javascript #ai

4 min read

Mag Solutions

Oct 5

pull_request_target in the wild: 60 public workflows, 6 exploitable, and the fixes that actually work

#security #githubactions #devops #opensource

4 min read

Mag Solutions

Sep 28

Field report: 3734 real pull requests scanned, 0 hallucinated packages confirmed

#security #supplychain #opensource #devops

2 min read

Mag Solutions

Sep 28

One dropper, five PyPI names — one of them a typosquat of a real Claude Code tool

#security #python #ai

4 min read

Mag Solutions

Sep 21

Field report: 1496 real pull requests scanned, 0 hallucinated packages confirmed

#security #supplychain #opensource #devops

3 min read

Mag Solutions

Sep 21

A package labelled itself "SECURITY RESEARCH." GitHub flagged it as malware anyway.

#security #javascript #ai

4 min read

Mag Solutions

Sep 18

Field report: 1246 real pull requests scanned, 0 hallucinated packages confirmed

#security #supplychain #opensource #devops

3 min read

Mag Solutions

Sep 14

langgrap, openaii, transfomers, ollamaa — one typo each, one PyPI campaign

#security #python #ai

4 min read

Mag Solutions

Sep 14

We measured how late a malware advisory arrives. Sometimes 95 days.

#security #javascript #ai

3 min read

Mag Solutions

Sep 9

Thirteen npm packages, 48 seconds, one fake wallet SDK

#security #javascript #ai

4 min read

Mag Solutions

Sep 9

What is slopsquatting, and why your scanner cannot see it

#security #ai

4 min read

Mag Solutions

Sep 9

The malicious package that never showed up in anyone's requirements.txt

#security #python #ai

4 min read

Mag Solutions

Sep 9

The package that never existed and got 30,000 downloads

#security #ai

3 min read

Mag Solutions

Sep 9

How to check whether a package actually exists before you install it

#python #javascript #security #ai

3 min read