#40 - IDE expansion packs, new package health database, and AutoFix now in AI pentest reports

3 Dec 2025

Features

• Expansion packs for the IDE: Introducing Aikido Expansion Packs, which brings Safe Chain and secret scanning via pre-commit hooks to your IDE. Stop sensitive patterns and malicious packages from ever reaching your shared codebase.

• Package health database: Search and compare 3 million+ open source packages to help identify which dependencies are well-maintained and safe to use. Aikido calculates a health score based on how often a package changes, who maintains it, what scripts it runs, and whether its builds are verifiable.

• Autofix for pentest issues: Aikido will now generate AutoFix previews for critical and high severity issues discovered by Aikido Attack. Act on the AI pentesting report and open a PR fix directly from the Aikido app.

• VSCode full workspace can: You can initiate a full workspace scan for SAST and secret issues to help you establish a security baseline for your codebase or assess security posture before a major code push. This works alongside the existing functionality that scans as individual files are opened or saved.

Aikido Intel - Malware & Vulnerability Database

Our research team has discovered over 96 new vulnerabilities over the last three weeks! Also, read our research and analysis on the ongoing Shai Hulud supply chain attacks.

Improvements

• Attack - Added support for uploading files as additional context in AI pentests

• Attack - Mitigate server load by setting maximum requests per second in safety settings

• Clouds - Generate report and map rules for CIS AWS benchmark

• Clouds - New Kubernetes agent release includes SBOM and deployment metrics collection, and support for external secrets

• Clouds - Kubernetes cluster scanning improvements including improved caching for very large clusters and workload identity support for image pulls

• Code Quality - Added new code quality rules for Apex XSS and generic JavaScript path traversal

• Platform - Release Aikido Broker for scanning internal, non-internet facing applications

• Virtual machines - New VM Agent Scanner release includes support for U.S. and Middle East regions as well as submitting package versions in SBOM

• Zen Firewall - Agent releases for Dotnet, Java, Python, PHP, Ruby, Golang and Node

• IDE - New releases for VSCode, Jetbrains and Visual Studio

• API - Added new public API endpoing to change internet connectivity setting for containers