Hackstack Security

We're a dedicated Team of Cyber Security Professionals providing quality VAPT , IT Auditing and IT Security Consultancy.
📩 DM To Get Your Pentest Done.

[Hackstack Security @hackstacksec]

70% of cybersecurity is filled with only script kiddies

[Het Mehta @hetmehtaa]

unpopular opinion that will put you in a situation like this

[Hackstack Security @hackstacksec]

@hetmehtaa True

[Hackstack Security @hackstacksec]

@hetmehtaa Helpful

[Het Mehta @hetmehtaa]

List of Compromised Packages of Active NPM Supply Chain Attack - Mini Shai-Hulud (May 11, 2026)

@tanstack/react-router 1.169.5, 1.169.8
@tanstack/vue-router 1.169.5, 1.169.8
@tanstack/solid-router 1.169.5, 1.169.8
@tanstack/router-core 1.169.5, 1.169.8
@tanstack/react-start 1.167.68, 1.167.71
@tanstack/router-plugin 1.167.38, 1.167.41
@tanstack/eslint-plugin-router 1.161.9, 1.161.12
@tanstack/eslint-plugin-start 0.0.4, 0.0.7
@tanstack/history 1.161.9, 1.161.12
@tanstack/nitro-v2-vite-plugin 1.154.12, 1.154.15
@tanstack/arktype-adapter 1.166.12, 1.166.15
@tanstack/react-router-devtools 1.166.16, 1.166.19
@tanstack/react-router-ssr-query 1.166.15, 1.166.18
@tanstack/react-start-client 1.166.51, 1.166.54
@tanstack/react-start-rsc 0.0.47, 0.0.50
@tanstack/react-start-server 1.166.55, 1.166.58
@tanstack/router-cli 1.166.46, 1.166.49
@tanstack/router-devtools 1.166.16, 1.166.19
@tanstack/router-devtools-core 1.167.6, 1.167.9
@tanstack/router-generator 1.166.45, 1.166.48
@tanstack/router-ssr-query-core 1.168.3, 1.168.6
@tanstack/router-utils 1.161.11, 1.161.14
@tanstack/router-vite-plugin 1.166.53, 1.166.56
@tanstack/solid-router-devtools 1.166.16, 1.166.19
@tanstack/solid-router-ssr-query 1.166.15, 1.166.18
@tanstack/solid-start 1.167.65, 1.167.68
@tanstack/solid-start-client 1.166.50, 1.166.53
@tanstack/solid-start-server 1.166.54, 1.166.57
@tanstack/start-client-core 1.168.5, 1.168.8
@tanstack/start-fn-stubs 1.161.9, 1.161.12
@tanstack/start-plugin-core 1.169.23, 1.169.26
@tanstack/start-server-core 1.167.33, 1.167.36
@tanstack/start-static-server-functions 1.166.44, 1.166.47
@tanstack/start-storage-context 1.166.38, 1.166.41
@tanstack/valibot-adapter 1.166.12, 1.166.15
@tanstack/virtual-file-routes 1.161.10, 1.161.13
@tanstack/vue-router-devtools 1.166.16, 1.166.19
@tanstack/vue-router-ssr-query 1.166.15, 1.166.18
@tanstack/vue-start 1.167.61, 1.167.64
@tanstack/vue-start-client 1.166.46, 1.166.49
@tanstack/vue-start-server 1.166.50, 1.166.53
@tanstack/zod-adapter 1.166.12, 1.166.15

@uipath/access-policy-sdk 0.3.1
@uipath/access-policy-tool 0.3.1
@uipath/admin-tool 0.1.1
@uipath/agent-sdk 1.0.2
@uipath/agent-tool 1.0.1
@uipath/aops-policy-tool 0.3.1
@uipath/ap-chat 1.5.7
@uipath/api-workflow-tool 1.0.1
@uipath/apollo-core 5.9.2
@uipath/apollo-wind 2.16.2
@uipath/auth 1.0.1
@uipath/case-tool 1.0.1
@uipath/cli 1.0.1
@uipath/codedagent-tool 1.0.1
@uipath/codedagents-tool 0.1.12
@uipath/codedapp-tool 1.0.1
@uipath/common 1.0.1
@uipath/context-grounding-tool 0.1.1
@uipath/data-fabric-tool 1.0.2
@uipath/docsai-tool 1.0.1
@uipath/filesystem 1.0.1
@uipath/flow-tool 1.0.2
@uipath/functions-tool 1.0.1
@uipath/gov-tool 0.3.1
@uipath/identity-tool 0.1.1
@uipath/insights-sdk 1.0.1
@uipath/insights-tool 1.0.1
@uipath/integrationservice-sdk 1.0.2
@uipath/integrationservice-tool 1.0.2
@uipath/llmgw-tool 1.0.1
@uipath/maestro-sdk 1.0.1
@uipath/maestro-tool 1.0.1
@uipath/orchestrator-tool 1.0.1
@uipath/packager-tool-apiworkflow 0.0.19
@uipath/packager-tool-bpmn 0.0.9
@uipath/packager-tool-case 0.0.9
@uipath/packager-tool-connector 0.0.19
@uipath/packager-tool-flow 0.0.19
@uipath/packager-tool-functions 0.1.1
@uipath/packager-tool-webapp 1.0.6
@uipath/packager-tool-workflowcompiler 0.0.16
@uipath/packager-tool-workflowcompiler-browser 0.0.34
@uipath/platform-tool 1.0.1
@uipath/project-packager 1.1.16
@uipath/resource-tool 1.0.1
@uipath/resourcecatalog-tool 0.1.1
@uipath/resources-tool 0.1.11
@uipath/robot 1.3.4
@uipath/rpa-legacy-tool 1.0.1
@uipath/rpa-tool 0.9.5
@uipath/solution-packager 0.0.35
@uipath/solution-tool 1.0.1
@uipath/solutionpackager-sdk 1.0.11
@uipath/solutionpackager-tool-core 0.0.34
@uipath/tasks-tool 1.0.1
@uipath/telemetry 0.0.7
@uipath/test-manager-tool 1.0.2
@uipath/tool-workflowcompiler 0.0.12
@uipath/traces-tool 1.0.1
@uipath/ui-widgets-multi-file-upload 1.0.1
@uipath/uipath-python-bridge 1.0.1
@uipath/vertical-solutions-tool 1.0.1
@uipath/vss 0.1.6
@uipath/widget.sdk 1.2.3
@mistralai/mistralai 2.2.2, 2.2.3, 2.2.4
@draftauth/client 0.2.1, 0.2.2
@draftauth/core 0.13.1, 0.13.2
@draftlab/auth 0.24.1, 0.24.2
@draftlab/auth-router 0.5.1, 0.5.2
@draftlab/db 0.16.1, 0.16.2
@beproduct/nestjs-auth 0.1.2-0.1.16
@dirigible-ai/sdk 0.6.2, 0.6.3
@ml-toolkit-ts/preprocessing 1.0.2, 1.0.3
@ml-toolkit-ts/xgboost 1.0.3, 1.0.4
@supersurkhet/cli 0.0.2-0.0.5
@supersurkhet/sdk 0.0.2-0.0.5
@taskflow-corp/cli 0.1.24-0.1.27
@tolka/cli 1.0.2
@opensearch-project/opensearch 3.6.2
agentwork-cli 0.1.4, 0.1.5
cmux-agent-mcp 0.1.3-0.1.6
git-branch-selector 1.3.3
git-git-git 1.0.8
ml-toolkit-ts 1.0.4, 1.0.5
nextmove-mcp 0.1.3
safe-action 0.8.3, 0.8.4
PyPI: guardrails-ai 0.10.1, mistralai 2.4.6

[Het Mehta @hetmehtaa]

“AI will replace your security team.”

Biggest marketing gimmick of the decade.

The same companies selling you AI Cyber models are watching zero-days spike and supply chain attacks hit record highs.

Turns out, AI made attackers faster too.

You don’t need less security talent.

You need more.

[Hackstack Security @hackstacksec]

@hetmehtaa ping 8.8.8.8

[Hackstack Security @hackstacksec]

@hetmehtaa @cprkrn This is crazy 🤯

[Hackstack Security @hackstacksec]

@hetmehtaa We will always secure your firm

[Het Mehta @hetmehtaa]

security hot take:

most companies don’t have a vulnerability problem
they have an ownership problem

everyone knows the old admin panel exists
nobody owns it

everyone knows the staging server is public
nobody owns it

everyone knows the API key is shared
nobody owns it

attackers don’t exploit code first

they exploit the gap between “someone should fix that” and “who exactly?”

[Het Mehta @hetmehtaa]

modern AI security checklist:

> does the agent have tools
> can it call APIs
> can it access private data
> can it send emails
> can it modify records
> can users influence its instructions
> does it separate system data from user data
> does it log tool calls
> can it be tricked into revealing hidden prompts
> can it take irreversible actions

if your AI can “help users” but nobody can explain its permissions

you built an intern with root access

[Hackstack Security @hackstacksec]

@hetmehtaa Thanks!

Never show up again

[Het Mehta @hetmehtaa]

Here's your Docker security arsenal that costs $0 but delivers enterprise-level protection. ( With Resources )

Skip the expensive tools. These free, open-source solutions are what Fortune 500 companies actually use in production.

[Hackstack Security @hackstacksec]

@Blackfolks27 @hetmehtaa @MrBeast He will

[Het Mehta @hetmehtaa]

Are we even getting the access of GPT 5.5-Cyber anytime soon for the form which we filled?

[Hackstack Security @hackstacksec]

@hetmehtaa Congratulations

[Hackstack Security @hackstacksec]

@hetmehtaa ❤️

[Het Mehta @hetmehtaa]

2026 reality check on privacy

The FBI openly buys your location history from data brokers, no warrant needed, just cash for commercially available tracking data. Confirmed in Senate hearings this year.

Meanwhile, massive breaches keep dumping SSNs, health info, and addresses (CarGurus: 12M+ users; others hitting millions monthly). Privacy teams are shrinking while AI quietly infers your health risks, politics, and future behavior from scraps of data.

We now have more “privacy controls” than ever, toggles, consents, laws in dozens of states and the EU AI Act. yet actual privacy is collapsing. Smart devices listen. Cameras scan faces in public. Your data trains models you never consented to.

This isn’t conspiracy. It’s policy, economics, and apathy meeting at scale. Governments and corporations treat personal information as a resource to buy, sell, or weaponize. Once your digital shadow exists, retracting it is nearly impossible.

The dangerous shift: We’ve accepted constant surveillance as the cost of modern life. Every “allow” click normalizes it further. If privacy becomes a luxury only the paranoid or wealthy can afford, the rest of us live in a monitored panopticon by default.

Concrete steps still matter: Use signal/encrypted tools where possible, minimize app permissions, support actual privacy-by-design defaults instead of theater, and question tools that demand your life story to function.

But individual habits won’t fix systemic collection. Without real pushback, stronger defaults, limits on inference and brokering, accountability for buyers like law enforcement, privacy doesn’t “erode.” It gets deliberately dismantled one dataset at a time.

What specific tracking have you noticed getting worse this year?

[Hackstack Security @hackstacksec]

@hetmehtaa H2O

[OccupytheWeb @three_cube]

This is so true!

I have seen the same innumerable times

[Hackstack Security @hackstacksec]

@hetmehtaa #April

[Hackstack Security @hackstacksec]

Hire us and we will not generate AI generated IR report

[Het Mehta @hetmehtaa]

there was a data breach today
i was asked to write the incident report

i wrote “stuff happened, data left, not my fault”

they said it needs to be more detailed

so i added “stuff happened at 3:47pm, data left through the internet, still not my fault”

they have hired someone else to write the incident report

the new person is asking me what happened

i told them stuff happened