Varun Badhwar

Founder & CEO of Endor Labs. Formerly founded RedLock / Prisma Cloud (acq PANW) and CipherCloud (acq Lookout). Angel investor and board member in startups.

[Endor Labs @EndorLabs]

We are investigating a potential supply chain incident in the #mastra ecosystem. It appears that a malicious actor compromised the org and added a malicious typosquat package as a dependency throughout numerous additional packages. Detailed analysis will follow.

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[Varun Badhwar @varun__badhwar]

nice work team @cursor_ai !

[Endor Labs @EndorLabs]

GPT-5.5 just set a new security record on our Agent Security League, through Cursor.
Through Codex? Ties for third, and trails by ~26 points on functional correctness.
Same model, same week, two harnesses, two very different results: https://t.co/boGRSmQC8L

[Varun Badhwar @varun__badhwar]

#claude Opus 4.7 reaches the highest functional and security scores we've ever measured. But roughly four out of five solutions still ship with vulnerabilities. 87% Functionally Correct and 20% Secure code.

https://t.co/lNcQCQRFGy

[Varun Badhwar @varun__badhwar]

@martin_casado AI generates large amounts of insecure code, and a human SWE keeps having to correct it? There goes your productivity 🥲secure prompts don’t help materially. This paper is worth a read https://t.co/XSa9holGjK

[Varun Badhwar @varun__badhwar]

@IceSolst Asking developers to pin all their dependencies would be a good start! Secondly, malware is usually found by researchers at @EndorLabs, @AikidoSecurity, @SocketSecurity, reported to npm and removed within hours 90 percent of the time. So slow your horses with upgrades just a bit

[Varun Badhwar @varun__badhwar]

@adnanthekhan Agree. It’s horrible. Jotted my thoughts here https://t.co/eLJF840DGG

[Preethy Padmanabhan @preepadu]

We have to defend 100% of the time, and the attacker only has to get it right once. Full house and insightful discussion on AI security @TiEcon with @varun__badhwar of @EndorLabs and @rishi_bhargava of @descopeinc

[Endor Labs @EndorLabs]

Don't let FOMO take the wheel! Escape the RSA frenzy with us with engaging discussions, plenty of laughs, and a well-deserved break. 🔥 This isn't just downtime; it's a chance to recharge! ⚡️ @GitHubSecurity #RSA 💌 RSVP now! [https://t.co/NpSn1Q9WF1

[Arif Janmohamed @arifj]

@lightspeedvp @EndorLabs @varun__badhwar .@varun__badhwar and team are not only addressing a massive, unmet need in the application security world, but are laying the foundation for a long and enduring company in a fast-growing market.

[James Rogers @jamesjrogers]

What happens when the bank that holds your company's funds collapses? @varun__badhwar, CEO & co-founder of @EndorLabs, describes the last 72 hours - my story for @MarketWatch with @jswartz #SiliconValleyBank #SVB https://t.co/69wQMrvA7f

[Abhishek Arya @infernosec]

Thanks @github for featuring @theopenssf Scorecard project on ReadME blog-"In Scorecard we trust" by @snaveen(Endor) & Brian Russell(GOSST)."If you’re looking to start improving your software supply chain security, adopting Scorecard is a great first step" https://t.co/pYbXo66kGX

[Varun Badhwar @varun__badhwar]

@anshublog @EndorLabs You’re too kind @anshublog 🙏

[Sean Falconer @seanfalconer]

80-90% of code in modern systems is borrowed.

Amongst the growing dependency graph, how do you know the projects are secure? Or whether the projects your dependencies depend on are secure?

@varun__badhwar of @EndorLabs joins me to discuss this problem:

https://t.co/toJh6NDWaG

[Varun Badhwar @varun__badhwar]

@ericabrescia You come prepared!

[Endor Labs @EndorLabs]

A few days ago we ran a poll asking how much time it takes a developer to investigate an OSS vulnerability.

24% reported it takes less than 2 hours - these were mostly security
55% reported it takes more than a day - these mostly devs

How would you explain the difference?

[Varun Badhwar @varun__badhwar]

@rakyll makes a case for that dependency removal engineer ;)

[Varun Badhwar @varun__badhwar]

Ever been in a security + engineering meeting that felt like a custody battle?

#EndorLabs #osssecurity #devsecops #softwaresupplychain #engineering #opensource

[Varun Badhwar @varun__badhwar]

@kelseyhightower @MayaKaczorowski @ChrisShort @yesthattom @copyconstruct @mdkail @travismcpeak @ankurdotshah I'm sure ya'll have never been there 😅