Semgrep – Weekly Recap

Semgrep spent the week spotlighting a series of software supply-chain attacks while rolling out product enhancements aimed at improving code security automation. The company’s researchers detailed a “Mini Shai-Hulud” campaign that has expanded from npm and PyPI into Packagist via the compromised intercom/intercom-php@5.0.2 package.

Semgrep noted that Packagist’s mirroring of Git tags may have allowed an attacker to overwrite an existing version and deliver a Bun-based payload through a Composer plugin triggered on post-install and post-update events. The firm framed this research as evidence of its cross-ecosystem threat visibility, potentially broadening its relevance across multiple language communities.

The company also highlighted a separate security incident involving PyTorch Lightning versions 2.6.2 and 2.6.3, which were reportedly compromised with Shai-Hulud malware. Semgrep Supply Chain customers received dedicated detection rules and an advisory panel, along with remediation guidance such as rotating tokens and credentials and auditing repositories.

In addition, Semgrep provided detailed checklists for organizations assessing exposure to the SAP-related npm “Mini Shai-Hulud” attack, emphasizing GitHub audit logs, suspicious commit patterns, and targeted credential rotation across cloud and infrastructure assets. These advisories reinforce Semgrep’s positioning as a responsive provider in the software supply-chain security market.

Beyond incident response, the company underscored ongoing R&D in static analysis, promoting its use of multiple “taint labels” to better model complex vulnerabilities and reduce false positives. This capability is aimed at capturing nuanced issues, such as XML external entity risks that depend on specific parser behavior and untrusted input conditions.

Semgrep also advanced its developer-focused roadmap by moving its Autofix capability into public beta, offering high-confidence code-change suggestions directly in pull requests. The feature is intended to embed security more passively into the build process and shorten remediation cycles, enhancing developer productivity.

Collectively, the week’s developments highlight Semgrep’s dual focus on emerging supply-chain threats and product innovation in application security. If the company can translate its incident research, advanced analysis features, and Autofix automation into broader adoption, it may strengthen its competitive standing and long-term growth prospects in the DevSecOps market.