Observed arrival · 2026-10-21
VibeVulns tracks security flaws in AI coding tools
A searchable advisory index for AI app builders, coding agents, MCP servers, models, and related frameworks.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- AI app builders and coding-agent users
- Worth noticing
- Its latest critical entries include malicious npm setup packages and an unauthenticated shell-command endpoint; one listing says no fixed release exists yet.
Field notes
The index separates six parts of the AI software stack, from prompt-to-app platforms to the frameworks generated code may rely on. Its latest critical section includes a report about eight npm packages using AI-tool names as bait, and another about a shell-command endpoint; the page says the latter has no fixed release yet. The homepage describes the advisories as source-linked, but the extracted evidence does not independently establish the reports or expose the full remediation details.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue