Seal Security raises $13 million in Series A funding to secure open source code at scale with vulnerability-free open source components.
A heap overflow in Jansi's JNI ioctl() wrapper lets a short int[] overwrite the native heap. CVE-2026-8484 affects every release, and Jansi is unmaintained.
Abandoned packages don’t get CVEs, so your scanner calls them clean. extract-zip sat on a public arbitrary file write for years. We assigned CVE-2026-19693.
Compare the four options for open source vulnerability remediation, price the real cost of doing nothing, and build a business case your execs will approve.
A missing bounds check in fflate's ZIP64 parser lets a 38-byte archive hang any service that unzips untrusted files. CVE-2026-45820, fixed in 0.8.3.
Seal Security found an OSC-8 ANSI escape injection in vercel-labs' skills CLI: a malicious skill can rewrite terminal output and forge clickable links.
A new denial-of-service flaw (CVE-2026-13149) in brace-expansion - an npm package with 38B+ downloads behind eslint, glob, and npm - can hang apps for minutes.
Agent skills install easily and stay trusted. We show how the skills CLI can be tricked into overwriting them via Unicode homoglyphs and flag-parsing bugs.
The best AI rollout is the one nobody noticed. Here's how Seal shipped three AI workflows with zero new tools to open, zero training, and zero behavior change.
Go beyond build-time blocking: neutralize malicious package versions across pipelines and production, without breaking CI/CD or slowing delivery.
How Seal Security secures its own supply chain, from hardware-signed commits to serverless infrastructure and human-in-the-loop AI security.
How patch-in-place remediation fixes direct and transitive open source vulnerabilities without risky upgrades, and what to look for in a platform.
When “latest” isn’t safest: how unpinned dependencies enable supply-chain attacks, why pinning is a security control, and how to update software safely and intentionally.
%20copy.jpg)
