Karim El-Melhaoui

Principal Security Architect & Partner at CloudSec Researcher. Find me at bsky

[Karim El-Melhaoui @karimscloud]

cc @travismcpeak

[Karim El-Melhaoui @karimscloud]

Every supply-chain attack affecting the npm ecosystem, the most common apps I find vulnerable are the vibe-coded ones due to lack of version pinning..

If @Cursor and other coding platforms make pinning the default, we'll see less runtime environments affected.

[Karim El-Melhaoui @karimscloud]

First P1 achieved, unfortunately a duplicate.

[Amitai Cohen @AmitaiCo]

Shai-Hulud 2.0, a tale of 4 graphs: many numbers have made the news in regards to this story - such as 800 compromised packages - but visualizing the data clearly shows the potential impact of hijacking even a small set of key packages (in terms of prevalence or dependents):

[Wiz @wiz_io]

🚨 New Shai-Hulud-style npm attack hitting 25k+ repos and growing fast.
Devs & CI/CD exposed via malicious preinstall. Wiz Research has detection + mitigation.
Details: https://t.co/vmAdV6kwtI

[Karim El-Melhaoui @karimscloud]

First talk at @OsloBSides

[Karim El-Melhaoui @karimscloud]

@gauravphoenix Nordnet’s social forum is usually good for nordic stocks: https://t.co/EIw39IjK38

[Karim El-Melhaoui @karimscloud]

@gauravphoenix Not an investment analysis but since you mention a Norwegian company: There’s declining interest rates affecting mortgage yield of Norwegian banks, they’ve had a historically good yield. There’s also the competitive landscape with Sparebank 1 SMN which is strong in the region

[fwd:cloudsec @fwdcloudsec]

The schedule for fwd:cloudsec Europe is out, with a single track of high-quality talks over 2 days, along with “Birds of a Feather” interactive sessions!

https://t.co/pZXdCbbxWP

Some sponsorship opportunities are still available

[Karim El-Melhaoui @karimscloud]

Great work by the @SpecterOps team adding Entra ID to GitHub attack paths! Will officially archive once I can validate it supports OIDC https://t.co/0SuTDNQgp2

[Karim El-Melhaoui @karimscloud]

Another year in the books as a Microsoft MVP🎉

[Karim El-Melhaoui @karimscloud]

I’m left wondering how many unpaid AWS bills are related to this.

[Department of Government Efficiency @DOGE]

Credit Card Update!

After 14 weeks, the program to audit unused/unneeded credit cards has expanded to 55 agencies resulting in ~610k de-activated cards.

As a reminder, at the start of the audit, there were ~4.6M active cards/accounts; more work to do!

[Karim El-Melhaoui @karimscloud]

@0xdabbad00 That’s a solid one!

[Karim El-Melhaoui @karimscloud]

Front row seat on @paulschwarzen session presenting OWASP Domain Protect at @AppSecEU 👏

[Karim El-Melhaoui @karimscloud]

Reminder that the fwd:cloudsec Europe 2025 Call for Papers is open!

First time speakers who requested feedback by May 30th and meet the submission criteria will receive feedback on how to improve during the second round.

For more: https://t.co/l3H54Q0miJ

[Karim El-Melhaoui @karimscloud]

@ainp0t @DrAzureAD Second this!

[Karim El-Melhaoui @karimscloud]

What happens if a lambda that puts an event to an S3 triggers on the same S3… I can’t afford to find out

[Liv Matan @terminatorLM]

🏃‍♂️Meet ImageRunner: A privilege escalation vulnerability I discovered in GCP Cloud Run.
Thank you for the @GoogleVRP team for working closely with us on this one.

*Stay tuned for more blogs to come!
https://t.co/Kzf9RlPR2u

[Karim El-Melhaoui @karimscloud]

@CraigHRowland Interested in reading your research, where may I find it?

[Karim El-Melhaoui @karimscloud]

@Flangvik @TrustedSec Awesome comeback