“Can you trust the MCPs on GitHub without running your own scans?” In this clip with Hacker Valley Media, Varun Badhwar and Henrik Plate talk about a hard truth: We’ve built implicit trust into open source. And attackers are exploiting it every week. Whether it’s traditional dependencies, MCPs on GitHub, or models pulled from Hugging Face, third-party code needs to be vetted like anything else running on your system. Trust is not a control. Verification is. https://lnkd.in/gdRv_p9D #AppSec #MCP
Endor Labs
Software Development
Palo Alto, California 15,905 followers
Application Security Platform for the Software Development Revolution
About us
Endor Labs is the AppSec platform built for the AI era. It helps teams find, prioritize, and fix the most critical risks in code, whether written by humans or AI—faster. Endor Labs understands the entire structure of your codebase, from 40 year-old C++ to modern Bazel monorepos. Powered by AI agents and the industry's richest security dataset about open source code, Endor Labs doesn’t just flag issues, it reduces noise, prioritizes what matters most, and proposes intelligent remediations based on the context of your code. Whether you’re an upstart or in the Fortune 500, Endor Labs helps AppSec and development teams eliminate noisy alerts, fix code 6.2x faster, and stay compliant with standards like FedRAMP, PCI, SLSA, and NIST SSDF.
- Website
-
https://www.endorlabs.com/
External link for Endor Labs
- Industry
- Software Development
- Company size
- 51-200 employees
- Headquarters
- Palo Alto, California
- Type
- Privately Held
- Founded
- 2021
- Specialties
- SCA, cybersecurity, open source security, devsecops, software supply chain security, SDLC, AI Model Discovery, Container Scanning, and SAST
Products
![Click here to view Endor Labs]()
Endor Labs
Static Code Analysis Tools
Endor Labs is the shift-left application security platform purpose-built for modern software development. As code becomes increasingly generated by AI and stitched together from open source, traditional AppSec tools fall short—overwhelming teams with noise and missing what really matters. Endor Labs builds a complete graph of your software estate, so teams can pinpoint and fix critical risks in complex, dependency-rich code—whether written by humans or AI. The unified platform combines Reachability-based SCA, SAST, Secrets, CI/CD, and Container Scanning—powered by program analysis and AI—to identify, prioritize, and fix only the risks that actually impact your applications. ✅ Cut 90% of false positives with function-level reachability ✅ Remediate 6x faster with intelligent fix suggestions and Endor Patches ✅ Secure AI-generated code with multi-agent code review and AI model governance ✅ Automate policy enforcement with precision—no more breaking builds over theoretical risks
Locations
-
Primary
Get directions
658 High St
Fl 1
Palo Alto, California 94301, US
-
Get directions
Amsterdam, NL
-
Get directions
477, 24th Main Rd, Parangi Palaya, 1st Sector, HSR Layout
Bengaluru, IN
Employees at Endor Labs
Updates
-
Great evening with the OWASP Saint Louis community. Thanks to everyone who joined, both in person and online. We had attendees from across the U.S. and around the world, and the energy in the room (and on the stream) was great. Appreciate OWASP St. Louis for hosting, and thanks to Nate Michalov and Jake Federlick for making it a fun and thoughtful session! #AppSec #OWASP #OWASPStLouis
-
-
Most companies today deal with tens of thousands of alerts from code scanning tools. That overhead becomes a tax on both security and developer productivity. We built Endor Labs differently. An AI-native platform designed with code context at the center. The result: - ~90%+ reduction in security alerts - Faster remediation, because fixes come with real context developers can act on - Security that fits naturally into AI-native development workflows, including coding agents and MCP integrations The goal isn’t more alerts. It’s quieter pipelines, faster fixes, and more secure software, by default. https://lnkd.in/gdRv_p9D #AppSec #MCP
-
Why reachability matters in SCA (and why transitive dependencies are the real risk). If you’re using Software Composition Analysis, finding vulnerable packages is only half the story. The real question is: can your application actually reach that vulnerable code? In this video, Robert Haynes, Endor Labs Technical Marketing Engineer, explains 👇 • What “reachability” really means in AppSec • Why transitive dependencies are where most teams get tripped up • How reachability cuts noise and helps teams focus on issues that actually matter If you’re tired of long vulnerability lists that don’t map to real risk, this one’s for you. https://lnkd.in/gtbzCe_U #ApplicationSecurity #AppSec #SCA #SoftwareSupplyChain #DeveloperExperience #DevSecOps
-
Check out this detailed write-up from security researcher Cristian-Alexandru Staicu about 8 node.js CVEs disclosed today. #nodejs #appsec #CVE #vulnerability
After multiple postponements, Node.js released minutes ago a security patch containing eight vulnerabilities: https://lnkd.in/deYctRdj. All Node.js users are encouraged to migrate to the patched version to prevent exploitation of production systems. Below, I break down my assessment of these vulnerabilities, focusing on the likelihood of exploitation for each of them. Four of the vulnerabilities are denial of service (DoS) vulnerabilities that can cause hard crashes or memory leaks, potentially allowing attackers to take down Node.js servers with low-volume DoS attacks. However, they only affect certain types of applications, e.g., that use "pskCallback" during TLS handshake or that do not set error handlers on TLSSockets. The HTTP/2 vulnerability (CVE-2025-59465) seems to be the most serious out of them since it enables reliable, remote DoS attacks that can bring down Node.js instances with a single crafted request. Thus, IDS systems should be configured to discard HTTP/2 requests with oversized, invalid HPACK data in HEADERS before they reach your Node.js instances. Three of the vulnerabilities are related to Node.js's recently introduced permission model: https://lnkd.in/dkfKehY6. These vulnerabilities are very similar to the ones we described with Abdullah AlHamdan for Deno (https://lnkd.in/dEbtgBVd), allowing attackers to bypass the permission system via symbolic links or other powerful UNIX primitives. However, the permission system is not yet widely adopted by Node.js applications, and these attacks require specific permission configurations, making remote exploitation extremely unlikely. More interesting, the vulnerability CVE-2025-55131 allows reading uninitialized memory values via race conditions. However, this vulnerability only affects specific buffer-related APIs like Buffer.alloc when run inside the "vm" module. Since the "vm" module has been repeatedly marked by Node.js maintainers as inappropriate for running untrusted JavaScript code (see the documentation https://lnkd.in/d5459Kzz, this discussion https://lnkd.in/dWKKMXxQ and our work on JS sandboxing at https://lnkd.in/dWyyMVQv), the likelihood that attackers can trigger this race condition remotely should be very low, if developers followed this recommendation. That is, without in-process + in-vm execution, attackers will have a hard time 1) finding production applications that use this module (vm) that is mainly intended for testing and not for running untrusted code, 2) force the application to run specific APIs inside the "vm" context, 3) control timeouts and other timing-related parameters to force the uninitialized buffer via the race condition, 4) obtain the value of the unitialized buffer from the vm. See more details in our Endor Labs blog post: https://lnkd.in/dGPZ5pVY
-
We’re excited to welcome our newest Ewoks to the Endor Labs team! - Krunal Patel, Sales Development Representative - Abhishek Jain, Product Operations Manager - Ramachandran Diraviyam, Account Executive - Peyton Kennedy, Senior Security Researcher - Robert (Bobby) Martinez, Account Executive - Sai Bhargav, Senior Customer Success Engineer Glad to have you with us 💚
-
-
There is a new supply chain attack targeting the n8n ecosystem. npm has removed multiple malicious packages, but attackers could re-use this tactic. ⚠️ What happened? A malicious npm package, disguised as a legitimate Google Ads integration, was published as an n8n community node. Once installed, it quietly harvested OAuth tokens and API keys during normal workflow execution and exfiltrated them to an attacker-controlled server. 🤔 Why does it matter? This attack is dangerous because organizations have trust that any installed node inherits in the ecosystem. This mirrors earlier campaigns like Shai-Hulud, which abused GitHub Actions workflows. Attackers are moving “up the stack” to platforms that centralize credentials and automate business logic. 🛠️ How can you reduce n8n risk? 1️⃣ Use official nodes and prefer n8n's built-in integrations 2️⃣ Audit packages before installing them 3️⃣ Scrutinize package metadata 4️⃣ Monitor outbound network traffic 5️⃣ Use isolated service accounts with the least privileges Read the deep dive here: https://lnkd.in/gzcFxNGG #malware #n8n #npm
-
-
Join Nate Michalov for the #OWASP St. Louis Meetup: Lessons from npm’s Dark Side: These Are Not the Packages You’re Looking For. The JavaScript ecosystem, especially npm, is a prime target for supply-chain malware, and with JavaScript powering the web, the impact is widespread. We’ll cover why attackers target npm, walk through real attack examples, and share what you can do to protect yourself and your organization. 🗓 January 13, 2026 ⏰ 6:00–7:30 PM Register here: https://lnkd.in/gkYWKAjH #StLouisMeetup #AppSec
-
-
Endor Labs reposted this
Can you actually trust the MCPs you’re pulling straight from GitHub? 👀 Unverified code running in your environment shouldn’t feel normal. Varun Badhwar, Co-Founder & CEO of Endor Labs, and Henrik Plate, Principal Security Researcher and co-author of State of Dependency Management 2025, join us on this week’s episode. They're breaking down how AI-assisted development is changing the SDLC, why agents and MCP servers are a growing supply chain risk, and what security teams need to do before speed turns into chaos. New episode out now wherever you get your podcasts! 🎙️ #Cybersecurity #AI #MCP