Echo eliminates 1,400 CVEs in NanoClaw's container images
We eliminated 1,400 CVEs in NanoClaw's container images
Echo's partnership with NanoClaw aims to harden the open-source project's container images. By using multiple scanners, they identified over 1,400 CVEs, then systematically bumped safe upgrades, backported critical fixes, and leveraged Echo OS to patch OS-level vulnerabilities. The result: a 99% reduction in CVEs, with remaining ones continuously monitored. This post details the process, including a complex backport of CVE-2025-59375 in expat, showcasing Echo's AI-driven patching agents and commitment to upstream compatibility.
The final patch is 9 files, 64 hunks, +786/-112, with the complete upstream test suite passing.
- halestock
Pretty impressive to introduce 1400 CVEs in a project that's only ~7 months old.
- prymitive
For those unfamiliar, “CVE” stands for “CV Enrichment”, common slang in Posture Engineering
- tptacek
If you're not a security person, the unspoken subtext here: the overwhelming majority of these "CVEs" do not matter to the project, and a very large number of them don't matter at all. They're pro-forma findings, like ReDOS in code paths that are rarely used, or, even more commonly, "prototype pollution" issues.
- aliasxneo
I'm convinced you can tackle 5-10 "CVEs" a day, make a little dashboard, put some pretty graphs on it, and send it to your exec team and probably get accolades. Nevermind that the CVEs had nothing to do with your product.
- evanjrowley
Why is the Node ecosystem like this? Why do people continue to choose it for popular projects vs. anything else?