diff --git a/README.md b/README.md index fd1034f2..1f4bcca0 100644 --- a/README.md +++ b/README.md @@ -240,6 +240,7 @@ If you maintain an open-source JavaScript or TypeScript project and want CVE Lit ## Press +- **[Sniff out stale AI override advice with this open source CLI](https://www.theregister.com/security/2026/06/23/sniff-out-stale-ai-override-advice-with-this-open-source-cli/5259853)** — The Register (Thomas Claburn, Senior Reporter), June 2026 - **[OWASP Adopts CVE Lite CLI to Boost Dependency Scanning](https://devops.com/owasp-adopts-cve-lite-cli-to-boost-dependency-scanning/)** — DevOps.com, May 2026 - **[CVE Lite CLI repère les dépendances à risque](https://www.lemondeinformatique.fr/actualites/lire-cve-lite-cli-repere-les-dependances-a-risque-100270.html)** — Le Monde Informatique (France), May 2026 - **[Lieferketten-Angriff: 5.500 GitHub-Repos in 6 Stunden kompromittiert](https://www.ad-hoc-news.de/wissenschaft/lieferketten-angriff-5-500-github-repos-in-6-stunden-kompromittiert/69418833)** — ad-hoc-news (Germany), May 2026 (references CVE Lite CLI) diff --git a/website/docs/press.md b/website/docs/press.md index 316fea4c..c0a00385 100644 --- a/website/docs/press.md +++ b/website/docs/press.md @@ -15,6 +15,18 @@ Coverage from security publications, technology news outlets, and industry media --- +### The Register + +**[Sniff out stale AI override advice with this open source CLI](https://www.theregister.com/security/2026/06/23/sniff-out-stale-ai-override-advice-with-this-open-source-cli/5259853)** + +*Thomas Claburn, Senior Reporter - The Register, June 2026* + +> "Overrides look like a security fix in package.json, but routinely outlive their purpose - they can point at packages no longer in the dependency tree, apply to the wrong package manager entirely, or shift to an unintended version on every install." - Sonu Kapoor + +A dedicated feature by The Register's Thomas Claburn covering CVE Lite CLI's override hygiene auditing capability. The article surfaces a blind spot in AI coding assistant workflows: tools like Copilot and Cursor recommend override entries to patch transitive CVEs, but never prompt developers to revisit them once upstream fixes ship. CVE Lite CLI's `--check-overrides` flag detects stale, misapplied, and broken entries across real-world projects - the article cites findings across Cal.com (11 broken overrides), Jest, NoCoDB, and Next.js. The Register is one of the most widely read technology publications globally, with a readership spanning enterprise IT and security professionals. + +--- + ### SD Times **[Shift Left: How CVE-LITE CLI is Transforming Developer Security](https://sdtimes.com/security/shift-left-how-cve-lite-cli-is-transforming-developer-security/)** diff --git a/website/src/pages/index.tsx b/website/src/pages/index.tsx index f9c89f7a..f1291d37 100644 --- a/website/src/pages/index.tsx +++ b/website/src/pages/index.tsx @@ -59,6 +59,10 @@ const PRESS_OUTLETS: {label: string; href: string; src?: string; logoClass?: str src: 'img/press-helpnetsecurity.svg', logoClass: 'press-bar-logo--helpnet', }, + { + label: 'The Register', + href: 'https://www.theregister.com/security/2026/06/23/sniff-out-stale-ai-override-advice-with-this-open-source-cli/5259853', + }, { label: 'ReversingLabs', href: 'https://www.reversinglabs.com/blog/cve-lite-cli',