Vinod Tiwari

Web3 Security, solutions architect, bug hunter, DevSecOps.

[Vinod Tiwari @securient]

🚀 The Web Almanac 2025 is live!

Proud to have authored the Privacy chapter and reviewed the Security chapter for this year's edition.
The Web Almanac is HTTP Archive's annual deep-dive into how the web is actually built, analyzing millions of sites with real data, peer review, and 90+ contributors.

Key finding: 75% of sites have at least one tracker 👀

📖 Privacy: https://t.co/XWIrNXtve8
🛡️ Security: https://t.co/y0Qqonktoe

#WebAlmanac #Privacy #Security #InfoSec

[Alexandra Elbakyan @ringo_ring]

Here is my most recent project: https://t.co/oSMutzh6yp

Unlike Sci-Hub and Sci-Net, where I have written all the code manually be hand, this one is pure AI generated - I decided to do this as a kind of experiment. LOVE the result! AI is 50x speedup in code writing, however creating the project is still a lot of work (human input is still needed for architectural decisions, debugging complex functionality and precise instructions)

Sci-Bot is connected to Sci-Hub database so it can read research articles and generate answers grounded in science. To pay for generated tokens, Sci-Bot supports two funding models: the first one is standard pay-as-your-go and the second one is legacy from Sci-Hub: it is donation based.

Anyone can donate: from these donations, the project will automatically calculate budget for upcoming month, and derive how much AI-generated answers it can serve to users for free.

[Vinod Tiwari @securient]

IDEViewer is the exact solution GitHub needed to solve their extension visibility problem on endpoints. It has single pane of glass view of all IDEs, IDE extensions, its permissions, and extension dependencies. Check it out at https://t.co/I9cs4PeDgh

@AikidoSecurity @TheHackersNews @wiz_io @msftsecresponse @msftsecurity

[Vinod Tiwari @securient]

@github Check out https://t.co/Z1qxeSemf4. This tool could have prevented the extension visibility problem and give you a single pane of glass view on who all have the same extension installed on their machines.

[Vinod Tiwari @securient]

@kfirgollan @github @grok I built https://t.co/Z1qxeSemf4 to solve the extension visibility and permission problem on endpoints. There is a portal option where you can find who all have installed the particular extension.

[whizwang @whizwang]

you never think this will happen to you, but this happened to me today.

a DPRK actor posed as somebody i previously worked with at the arbitrum foundation to have a catchup call. they reached out via telegram, in a channel where we had an existing messaging history.

the DPRK actor sent me what looked to be a legitimate teams link, but when i opened it, it said a software update was necessary, which entailed downloading and running a malicious file. in the group call, there was video of everybody on the call, including the person i had previously worked with.

stay vigilant and be safe! don’t be afraid to send out your own video conferencing links if you see something suspicious.

[Vinod Tiwari @securient]

@whizwang @tayvano_ This is classic.

[Vinod Tiwari @securient]

@AIHighlight just? Does every tweet need a clickbait title?

[Wiz @wiz_io]

🚨 BREAKING: Wiz Research discovered Remote Code Execution on https://t.co/SvN2lGsnbO with a single git push

The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

[Clive @Clive_99]

Solana traders showing up to buy ETH tokens

[Vinod Tiwari @securient]

@DEFCONCCVillage are you guys returning to Defcon 34?

[Param @Param_eth]

Sorry to say,

Lazarus Group is the top hardworking smart contract security auditor in the world.

Other auditors charge $50k and miss critical vulnerabilities.

These guys work for free and never leave any money from the contract.

Their resume:

• Bybit: $1.5 Billion
• Drift: $285 Million
• WazirX: $235 Million
• KelpDAO: $292 Million
• DMM Bitcoin: $308 Million
• Axie Infinity (Ronin): $625 Million

And many others.

[curb @CryptoCurb]

"so you staked your ETH on the Ethereum blockchain to earn yield?"

"yes, Dave"

"except you didn't want your capital to be locked up so you actually staked it with a liquid staking protocol called Lido?"

"that's correct, Dave"

"and Lido gave you a liquid staking receipt token called stETH in return?"

"yes, Dave"

"and then you didn't think that was enough, so you juiced the yield even further by depositing your stETH receipt tokens into a restaking protocol called Eigenlayer?"

"you are correct, Dave"

"and now you didn't want to lock up your capital, so you actually restaked with a liquid restaking protocol called KelpDAO who provided you with a liquid restaking receipt token called rsETH?"

"you got it, Dave"

"and then that was surely not enough juice, so you then deposited your rsETH tokens into a lending protocol called AAVE so that you could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero whose security is held together by a 1/1 toothpick, which was obviously hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry"

"you are 100% correct, dave"

jfc.

[Vinod Tiwari @securient]

GitGuardian wrote up the original BSides talk here: https://t.co/AVW8ZlMz91
If you're on a security team trying to get a handle on what your devs actually have installed — give it a spin and open issues. Feedback welcome.

[Vinod Tiwari @securient]

Open-sourcing IDEViewer today — the tool behind my BSidesSF 2026 talk on hunting malicious IDE extensions.
A single Go binary that scans developer workstations for the supply-chain risk your EDR and SCA can't see.
https://t.co/4r7gAjrjJO 🧵

[Vinod Tiwari @securient]

CVE correlation via https://t.co/zgkLhKHOdr. SARIF output for GitHub Code Scanning. Real-time fsnotify watchers catch extension installs within 30 seconds. Optional self-hosted portal for fleet visibility. MDM playbooks for JAMF/Mosyle/Kandji. Apache 2.0.

[Vinod Tiwari @securient]

Risk model for extensions: Critical / High / Medium / Low based on activation events, capabilities, and contributes.

AI configs get their own score — wildcard Bash(*), plaintext keys, autonomous exec, insecure transports all surface as Critical/High.

[Vinod Tiwari @securient]

What it scans on every dev machine:
• IDE extensions across 7+ IDEs (VS Code, Cursor, JetBrains family, VSCodium, Sublime, Vim, Xcode)
• Packages — incl. deps bundled inside extensions (invisible to SCA)
• AI tool + MCP configs (Claude Code, Cursor, OpenClaw)
• Plaintext secrets in .env + git history
• Tamper + --no-verify bypass

[Raúl @ethicraul]

Thanks for the kind words @PatrickAlphaC , great having you in our council.

"I think this is a very valuable role, and it’s something that the Story Protocol does very well. Their security council is often pinged for advice; we discuss industry hacks and open dialogue on how changes in the security landscape should drive action on the Story team. In this scenario, I think it’s important to separate this from a “Security Council” that has defined on-chain roles they often act on, vs. “Security Advisors” who advise on actions."

Go read the full article!

[sarick @sarick]

everyone’s impressed that deloitte is in physical AI now. i’m more interested in why nvidia needs them.

distribution is the hard part. nvidia has the stack. they need someone who can actually get it into 500 enterprise clients without it dying in procurement.

https://t.co/E0rgiRykJO

[Story Engineers @StoryEngs]

Story v1.6.1 Aeneid Testnet Required Upgrade

This release introduces Distributed Key Generation (DKG) and Confidential Data Rails (CDR) on Aeneid Testnet. This lays the foundation for on-chain confidential data management. https://t.co/EQLvzE6L7S

Upgrade triggers at block height 16332000 (Apr 1, 2026). Only Aeneid nodes need upgrade.

Read More ↴