Coyote Security Scanner

Open Source security scanner for Github repos and AI Agents. A @ZenOpenSource project 🧘‍♂️

[Coyote Security Scanner @CoyoteSecure]

@MatthewBerman I couldn't agree more. It's going to be pretty wild, we'll move from insane amounts of fear, to no fear.

[Coyote Security Scanner @CoyoteSecure]

We are about to live through one of the most interesting times in cybersecurity history.

From great fear, to no fear.

[Matthew Berman @MatthewBerman]

Soon, every piece of software in the world will have their vulnerabilities exposed. And then shortly after, no software will have vulnerabilities.

[Coyote Security Scanner @CoyoteSecure]

@thebellaacode Spot on, I couldn't agree more 🎯

[Coyote Security Scanner @CoyoteSecure]

Great list.

[Code4 Cybersecurity @Code4_CyberSec]

Here are a few of my favorite websites for OSINT/Web Recon:
1 - CentralOps https://t.co/J6EIvjvx4r
2 - ViewDNS https://t.co/qbhck39tQQ
3 - URLScan https://t.co/tvTG0kSEKb
4 - IP2Proxy https://t.co/y2x9H00xjA
5 - HostingThis https://t.co/9LTQ28f4gM
</CODE4>
#OSINT

[Coyote Security Scanner @CoyoteSecure]

@Code4_CyberSec Great list, I knew about less than half of these

[Coyote Security Scanner @CoyoteSecure]

Learn how hackers think.

[TheOuts1derX @TheOuts1derX]

18 resources to sharpen your hacking skills:

1. Hack The Box — https://t.co/7oO5M6a1qu
2. TryHackMe — https://t.co/eEs8iSpf72
3. PortSwigger Academy — https://t.co/crpuKFt7oa
4. PicoCTF — https://t.co/wNt3fXNTLQ
5. OverTheWire — https://t.co/1rLUnH5m1l
6. VulnHub — https://t.co/Cd4r3dlneA
7. PentesterLab — https://t.co/2Z6zddy8nh
8. Root Me — https://t.co/rqvqqjTrKm
9. crAPI (OWASP) — https://t.co/Mg11mOwqzK
10. Hacker101 — https://t.co/zTVH5TEXMb
11. OWASP Juice Shop — https://t.co/GLEq2VsIoe
12. CTFChallenge — https://t.co/h5Yb84zbD3
13. Metasploitable 3 — https://t.co/XuMmJhBrgd
14. YesWeHack DOJO — https://t.co/o4rpR0A1N8
15. APIsec University — https://t.co/UfPRmIRRLC
16. CryptoHack — https://t.co/jEQNdffdSj
17. Google CTF — https://t.co/PKDwlqPBNW
18. Hacking Hub — https://t.co/1OcljUYa9d

#bugbounty #bugbountytips #cybersecurity #hacking #infosec #ethicalhacking #pentesting #ctf

[Coyote Security Scanner @CoyoteSecure]

@oliviscusAI Oh wow, this is really neat, thanks for sharing!

[Coyote Security Scanner @CoyoteSecure]

@wearehackerone +1 to this, and the landscape is changing constantly, so anyone who was an expert a few months ago, might not be any more, so much to constantly learn

[Coyote Security Scanner @CoyoteSecure]

Just pushed a new update to Coyote as NPM-focused supply chain attacks seem to be on the rise. Here's the details on what was added:

- npm-specific supply chain detection added to Coyote’s core scanner.

- New checks catch suspicious install-time lifecycle scripts like risky preinstall/postinstall behavior.

- The scanner now flags remote dependency sources in package.json, insecure .npmrc settings, and Node lockfiles that use plain HTTP or lack integrity hashes.

- Wired the new findings into scoring, attack path analysis, and test coverage so they affect real risk evaluation.

[Coyote Security Scanner @CoyoteSecure]

Done ✅

New update to Coyote that adds a scan for the axios/npm supply-chain attack, details below 🔽

- add dedicated dependency findings for:
- compromised releases `[email protected]` and `[email protected]`
- IOC package `plain-crypto-js`
- include incident metadata, install-time execution context, and
remediation guidance in dependency findings
- ensure supply-chain IOC findings still fail CI under
`--deps-reachable-only` since this campaign executed at install time
- map new rule names into supply-chain attack-path analysis
- add tests for malicious axios releases, IOC package detection,
gate behavior, and attack-path categorization
- update README dependency scan docs with Axios incident coverage

[Coyote Security Scanner @CoyoteSecure]

Everyone should be aware of this. Adding a scan to Coyote this morning to specifically check for this specific threat vector.

[Mandiant (part of Google Cloud) @Mandiant]

Google Threat Intelligence Group is tracking an active supply chain attack 🔎

North Korea-nexus actor UNC1069 compromised the "axios" NPM package (v1.14.1 & 0.30.4), deploying the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.

Learn more: https://t.co/pII35aPpRA

[Coyote Security Scanner @CoyoteSecure]

@0xv1nx0 I care, congrats, that is AWESOME! 🐺

[Coyote Security Scanner @CoyoteSecure]

Just pushed a new update to Coyote Security to Github, and working on a second one now as the axios/npm supply-chain-attack is a big deal, and a perfect place to use Coyote.

First, here's the update I just pushed that I'm pretty excited about, adding a core feature ppl have been asking for.

feat(remediation): add actionable remediation guidance to findings and reports

Add remediation text across the finding pipeline so scan output is not just
descriptive, but also tells users what to do next.

- extend PatternMatch with a remediation field
- add remediation text to all secret and smell patterns
- add sensitive-file remediation lookup helper
- populate remediation in scanner findings for sensitive files, secrets,
smells, entropy hits, gitignore issues, and large files
- add upgrade/monitor remediation for dependency vulnerability findings
- include remediation in JSON, Markdown, HTML, and SARIF outputs
- add remediation-focused tests covering patterns, reports, SARIF, and
sensitive file behavior

Validation:
- python3 -m unittest tests.test_remediation

Now live on Github.

[Coyote Security Scanner @CoyoteSecure]

Looks like a pretty neat pentesting tool, haven't tried it yet myself but am likely going to play around with it this week.

[Cyber Security News @The_Cyber_News]

🛡️ PentAGI – Automated AI-Powered Pentesting Tool that Integrates 20+ Security Tools

Source: https://t.co/50TAGdMf5t

PentAGI introduces an AI-driven approach to penetration testing, automating complex workflows with tools like Nmap and Metasploit while generating detailed reports

The tool stands out for its fully autonomous AI agents that dynamically plan and execute pentests, integrating over 20 professional security tools, including Nmap for network discovery, Metasploit for exploitation, and sqlmap for database attacks.

Users define a target, and PentAGI’s multi-agent system, comprising researcher, developer, and executor roles, orchestrates the process, leveraging long-term memory to recall past successes and adapt strategies.

#cybersecuritynews

[Coyote Security Scanner @CoyoteSecure]

@vxunderground Ha, that is wild.

[Coyote Security Scanner @CoyoteSecure]

Just pushed a new update to Coyote, now live on GH.

Here's what's new:

Coyote can now generate CycloneDX v1.5 Software Bill of Materials from your dependency lockfiles. One command gives you a compliance-ready inventory across Python, npm, Go, and Rust projects.

- Supports requirements.txt, poetry.lock, package-lock.json, pnpm-lock.yaml, go.mod, and
Cargo.lock

- Generates spec-compliant PURLs for every component with proper ecosystem normalization

- Dev dependencies excluded by default — opt in with --include-dev

- For a full supply chain security workflowPairs with existingcoyote depsandcoyote gate

[Coyote Security Scanner @CoyoteSecure]

@MatthewBerman Very interested in that last one 👀

[Coyote Security Scanner @CoyoteSecure]

@Dinosn Oh yikes, good to know, and now glad I never used it!

[Coyote Security Scanner @CoyoteSecure]

This looks super interesting.

[Nicolas Krassas @Dinosn]

I built an open-source library of 700+ cybersecurity skills for AI coding agents -- covers DFIR, threat hunting, cloud security, and more https://t.co/vM5SgmXCrO

[Coyote Security Scanner @CoyoteSecure]

@Dinosn Ohhh, this looks very useful, thanks for putting this together Nicolas