Supply chain security reporter

Priya Menon

Articles: 10
Desks: 3

Reports on dependency compromise, build pipelines, and package ecosystem risk.

supply-chaincloud-securityvulnerability-intelligence

Coverage by Priya Menon

Data graphic: dark poster headlined "Our AI house plans fail the math", with a large red "at least 67'-4"" of labeled room widths in a 60-foot AI-generated barndominium, stamped "Doesn't add up". Smaller figures: a tiny house width of 25'-0" whose dimension string adds to 31'-0", and 9" treads against the IRC's at least 10".

Stock House Plans vs AI-Generated Plans: What a Code Check Catches

We had an image model draw three house plans, then broke an ADU template on purpose. What an IRC code check flags, and what it can't.

Oct 24 · 9 min

Muse Wonder API list price of $4 input and $20 output per 1M tokens, the same as Claude Opus 5.5; Wonder Full is plan-only

watchResearch Muse Wonder

Meta's Muse Wonder Costs the Same as Opus 5.5 on the API; Wonder Full Is Plan-Only

Meta's Muse Wonder is $4/$20 per 1M tokens on the API, matching Claude Opus 5.5. The stronger Wonder Full is only in $50 and $200 Muse Code plans.

Oct 12 · 6 min

Attack chain poster: installing tensorlake@0.5.144 runs a preinstall hook, a credential stealer takes tokens, and a GitHub token monitor is left behind, which reportedly wipes the home directory if the token is revoked per Socket .

highSupply Chain Supply Chain Attack

Tensorlake npm Worm: Revoking the Stolen GitHub Token Can Trigger a Home-Directory Wipe, Socket Says

Socket says the malicious tensorlake@0.5.144 npm release plants a token monitor that wipes the home directory if you revoke the stolen GitHub token first.

Oct 10 · 5 min

Data graphic: a CVSS 4.0 score of 8.5 High for GHSA-v234-4jrq-mgg6, a Claude Desktop Cowork flaw on macOS that runs commands when a file is opened. The path runs from an injected agent writing a file, to the Cowork shared folder, to the user opening it in Claude Desktop, to commands running on the Mac. Affected >= 1.1.3918 and < 1.15962.0, fixed in 1.15962.0, CWE-184.

highAI Security Claude Code

Claude Desktop Cowork Folder Flaw Let a File Run Commands on macOS

Anthropic fixed a Claude Desktop macOS flaw where a file an injected agent left in a Cowork folder could run commands when opened. Fixed in 1.15962.0.

Oct 2 · 4 min

Data graphic: LiteLLM salt-key flaw GHSA-7hp6-4w63-5g45, rated CVSS 3.1 9.9 Critical, shown as an attack path: an internal user submits crafted key metadata, the single salt key seals forged admin credentials, the bearer token is accepted, and the attacker gets proxy admin and command execution. First fixed on the 1.91 to 1.100 line in 1.100.4.

highAI Security Litellm Vulnerability

LiteLLM Salt-Key Flaw Lets Any Internal User Forge a Proxy Admin Token and Run Commands

A 9.9-rated GitHub advisory says LiteLLM's reused salt key lets an internal user become proxy admin and run commands. Two CVEs and another advisory landed too.

Oct 2 · 5 min

Data graphic: lollipop chart of median latency using Cloudflare's own figures: Clef-flash 38.8 ms, Clef 209.3 ms and Jev 524.1 ms.

watchResearch Open-Weight Models

Cloudflare Open-Sources Clef Decision Models as Ollama Adds a Decision-Model API

Cloudflare open-sourced Clef and Clef-flash, decision models that return probabilities in one pass, as Ollama v0.35 adds a /v1/systemone API.

Oct 2 · 5 min

Data graphic: Gemini 4 Argon costs $1.99 per task at its intro price, against $5.98 for Claude Opus 5.5, $3.26 for GPT-6 Astra and about $3.98 for Argon at full price. Opus is about 3x Argon's intro cost but leads the Artificial Analysis Intelligence Index, 57.6 to 52.6. The intro price of $2/$10 per 1M tokens in/out runs until 30 Nov, then $4/$20 from 1 Dec, and Argon has been on the Gemini API and GitHub Copilot since 13 Oct.

watchResearch Gemini 4 Argon

Gemini 4 Argon vs GPT-6 Astra vs Claude Opus 5.5: Is Google's New Model Actually Better?

The leaked 'Gemini 4 Pro' was billed as an Astra and Opus killer. The real Gemini 4 Argon wins Google's tests, ties Astra on neutral ones, and is cheap for now.

Oct 1 · 7 min

Data graphic: Astra vs Fable vs Opus. GPT-6 Astra $10 / $50; Claude Fable 5.1 $10 / $50; Claude Opus 5.5 $4 / $20

watchResearch Gpt 6 Astra

GPT-6 Astra vs Claude Fable 5.1 vs Opus 5.5 for Coding: Benchmarks and Real Cost

Opus 5.5 lists at $4/$20, Astra and Fable 5.1 at $10/$50. We compare cost per completed task, sourced benchmarks, speed, context and caching.

Sep 24 · 15 min