🌈  Neil Andrew

Founder at Lunio, one of the UK's most exciting AdTech SaaS scaleups, where I've taken the business from bootstrapped beginnings to 60+ employees, $20m+ raised in venture capital raised, contributed to 7-figure deals and generated 8-figure recurring revenue streams.

We eliminate invalid traffic (IVT) across your performance marketing media buys, ensuring you only pay for real, legitimate, human traffic and your data is actionable & clean.

If you're a founder at a startup or scaleup open to networking please reach out. I'm always looking to expand my network and learn from others where possible!

Angel Investor & Member

🌈 Neil Andrew

☁️ Francesco ☁️ Cipollone

Reduce risk - focus on vulnerabilities that matter - Contextual ASPM - CEO & Founder - Phoenix security - 🏃‍♂️ Runner - ❤️ Application Security Cloud Security | 40 under 40 | CSA UK Board | CSCP Podcast Host

As the CEO and Founder of Phoenix Security, I lead efforts to revolutionize application security through actionable Application Security Posture Management (ASPM), leveraging machine learning and threat intelligence to accelerate vulnerability resolution by up to 40%. With over four years of experience at the helm, our team empowers organizations to quantify risk reduction and demonstrate the ROI of software security initiatives.  

Additionally, as a faculty member at IANS, I specialize in application security, cloud security, and vulnerability management, providing expert insights and education to elevate organizational security postures. Passionate about fostering innovation in cybersecurity, I collaborate with teams and leaders across industries to create measurable impact while maintaining a commitment to empowering secure engineering environments.

CEO & Founder - Diversity Champion

Working on the future of Application Security Vulnerability Management powered by machine learning, and enriched by threat feed. 
Accelerate the detection and resolution of vulnerability up to 30-40% faster. 
Calculate RoI of security in software and quantify the risk reduction of software security

I tought we were arguing about claude code, and sandwarm appeard inside the repo …

Everyone is busy talking about securing AI coding assistants.

Meanwhile, SANDWORM_MODE is doing something far more practical:
infecting npm, stealing tokens, rewriting repos, and quietly looping through CI.

This is a Shai Hulud style supply chain worm. One typo. One install. Then:

TLDR

- Typosquatted npm packages execute on import
- Steal npm, GitHub, CI, cloud, SSH and LLM API keys
- Modify package.json and lockfiles
- Inject malicious GitHub Actions workflows
- Persist via git config --global init.templateDir
- Drop a rogue MCP server into AI assistant configs

This is not a single host issue. It is repo propagation plus CI amplification.

Exact malicious versions
claud-code@0.2.1, cloude-code@0.2.1, cloude@0.3.0, crypto-locale@1.0.0, crypto-reader-info@1.0.0, detect-cache@1.0.0, format-defaults@1.0.0, hardhta@1.0.0, locale-loader-pro@1.0.0, naniod@1.0.0, node-native-bridge@1.0.0, opencraw@2026.2.17, parse-compat@1.0.0, rimarf@1.0.0, scan-store@1.0.0, secp256@1.0.0, suport-color@1.0.1, veim@2.46.2, yarsg@18.0.1
Watchlist: ethres, iru-caches, iruchache, uudi

Why this is different from earlier Shai Hulud variants

Variant 1, 2 and 3 focused on npm plus credential harvesting plus repo spread.

SANDWORM_MODE escalates:

Built for changeability and mutation
Uses GitHub Actions as a propagation engine
Actively poisons AI tooling via MCP injection

This is dev laptop + CI + assistant compromise in one chain.

What to do immediately

Hunt and remove those exact package versions everywhere
Rotate GitHub, npm, CI, cloud, SSH and LLM keys if installed
Audit .github/workflows for unexpected pull_request_target usage
Check git config --global init.templateDir
Check assistant configs for unexpected mcpServers entries

Quick detection option

Open source scanner:
in comments

Run:
python3 https://lnkd.in/enDeHJ7Y your_repo --enable-phoenix --output scan-report.txt
Clean result: no package hits, no workflow implants
Bad result: treat as credential exposure + repo integrity incident

We can harden Claude Code all we want.
Thanks to Socket for the original disclosure, we better together when the intel is distributed fast 

If your npm graph is poisoned, your CI becomes the attacker’s automation layer.
Full analysis in the comment section

#malware #sandworm

We going to see the new generation of hackers here :) script kiddies now vibe hackers will emerge from here. 

I Kew and embraced llm from the first baby steps but the extent those tool have fundamentally change the industry is mind blowing. 

When people called it bubble and dotcom moment I tought. There is real money and fundamental application in this. 

Welcome to the era of ai everything 

#ai #security #vibecoding

No alternative text description for this image

Claude code has killed sast, cloud code has killed the whole cybersecurity market… defence in depth still matters!

Claude's code security is a great skill and a one-click assessment for small apps. I used the same tool in Lovable, and it is great for a quick fix and assessment. 

At enterprise scale? It's good, maybe for a fix or two, but can you practically measure the issue and handle the complexity window?

Complexity is not “more files”. It’s more trust boundaries, more shared services, more IAM edges, more release trains, more compensating controls, more exceptions. A repo-only view will miss why something is safe in one place and catastrophic in another.

Check out Pramod Gosavi post has some good take on the whole market 

I wanted to make 3 points

1) Vibe coding vs enterprise reality

Claude Code can move fast when the problem is local and the blast radius is small. Enterprises live in distributed systems and policy constraints.
	•	Multi-tenant boundaries, data residency, regulated workflows
	•	Dependency graphs with pinned versions, internal forks, and signed artifacts
	•	Shared libraries where a “simple fix” becomes a platform change
Low friction is a feature. Without architecture and guardrails, it becomes a multiplier for unsafe assumptions.

2) The attacker gets the same leverage

The uncomfortable bit: the same reasoning used to locate and patch issues can be used to locate and exploit them.
	•	Faster discovery across large codebases
	•	Better chaining across weak links (auth edge cases, unsafe deserialization, SSRF paths)
	•	More rapid weaponisation once a pattern is found
Security teams cannot treat AI scanning as a nice-to-have. It is now table stakes because the opposing side has similar tooling incentives.

3) The real pull is the enterprise remediation loop

AI SAST is useful. The enterprise win is the full review and remediation cycle:
	•	A consistent workflow for triage, ownership, and prioritisation
	•	Policies that translate findings into enforceable defaults
	•	Fixes that land safely across versions, containers, and environments
This is where AI has more pull: not just finding issues, but compressing the cycle from “finding” to “verified fix in production” with traceability.

My take: Claude Code makes scanning and patch suggestions cheaper. The differentiator is whether your organisation can turn that into a governed remediation engine, not a token-burning firehose.

If you’re rolling this out, the hard questions are simple:
	•	Who owns fixes by service and team
	•	What rules prevent unsafe refactors
	•	How you validate impact across code, dependencies, container builds, and runtime exposure

#cloudecode #appsec #enterprisecoding

taplio

The Battle

🌈 Neil Andrew

☁️ Francesco ☁️ Cipollone

Followers

Posts

Engagements

Likes

Performance Score☁️ Francesco ☁️ Cipollone's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

🌈 Neil Andrew

☁️ Francesco ☁️ Cipollone

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}☁️ Francesco ☁️ Cipollone's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance Score☁️ Francesco ☁️ Cipollone's LinkedIn Performance