AppSec News Roundup on Claude Code Leak, Axios NPM Compromise, Secure Design - Idan Plotnik, Raj Mallempati - ASW #377

In this episode of Application Security Weekly, host Mike Shima and guest John Kinsella dive into the latest AI-driven security threats and shifts in software development. The discussion begins with the Anthropic Claude code leak via a compromised NPM map file, highlighting how even junior researchers can uncover critical vulnerabilities. The team then examines the Axios NPM supply chain compromise, where a maintainer was socially engineered into installing malware, underscoring the importance of secure publishing practices and organizational response. The conversation shifts to agentic coding, with Cloudflare’s MDash project presented as a secure-by-design alternative to WordPress, emphasizing modular, agent-friendly architecture. The episode explores the future of AppSec, questioning whether traditional vulnerability detection is sufficient in an era of AI-generated code. This leads to a deep dive into identity and access risks, with Raj Malampati of Blue Flag Security and Idan Plotnik of Apiro discussing how non-human identities—especially AI agents—introduce new attack surfaces. Apiro’s 'Secure Prompt' technology is highlighted as a proactive solution that prevents vulnerabilities before code is generated by enriching prompts with real-time software and compliance context. The episode concludes with a call to evolve AppSec from reactive detection to seamless, intelligent prevention.