JP Lewin

Foundy

Head to one of the links in my profile’s *Featured* section to learn more about how we have transformed M&A through Foundy's AI agents and expert advisory service. 

When millions can be gained (or lost) during and after an acquisition event, it is vital that business owners and buyers surround themselves with the right deal flow, community, tools, and expert advisors that specialise in their market niche for their long term acquisition planning and transaction processes. Yet, the process has historically been riddled with inefficiencies, eye watering fees and fragmented processes that leaves stakeholders at a disadvantage.

Foundy offers 2 sell side products and specialist advisory services:

The first is long term exit planning (6 to 36 months from selling): 
1a.) Detailed business valuation report
1b.) Exit readiness score and growth roadmap packed with helpful step by step support and tools
1c.) Tailored buyer list with contact details and insights into how you can position your business to make it as attractive as possible for an acquisition. This has helped businesses unlock millions in additional value. 

Our second product is Deal Execution for business owners ready to sell in the near term
2a.) Centralised deal management portal enabled by AI
b.) Expert advisors, including Foundy's seasoned team and hand selected specialist from you (our client)'s specific industry niche. We will ready your business for sale, find buyers, secure higher acquisition offers and then navigate the end to end DD and legal document process.

On the buy side:
Our popular Buyer Essentials package grants buyers access to an exclusive business buyer community where they access a high profile network and valuable resources. It is designed to set them on a path towards a successful acquisition, including improving their access to quality deal flow, funding and more.

Head to Foundy.com to learn more

Founder and CEO

Focal

Foundy was voted in the top 3 companies out of 1900 (0.16%) that applied to competitive demo day called Focal. This was based on the number of upvotes pre-demo day and the number of meeting requests post-demo day.

S23 Alumni - Voted In Top 3 out of 1900 companies

Pavilion

Pavilion is a community-powered learning platform for B2B SaaS go-to-market executives and their teams.

Executive Member

Revenue Syndicate

Revenue Syndicate is a platform for B2B Saas leaders and angels to access a high-quality deal flow of investment opportunities. It was founded by leading experts in the market and has since become a 500 + member community.

Member and Angel Investor

ZWINGS

Zwings is a SaaS enabled marketplace. At the time of acquisition, we had 80,000 customers and retained major contracts for 4 consecutive extension periods, including one of the UK's most lucrative contracts. We repeatedly outcompeted companies with over 100x more funding than us in head to head tenders. I had a team of 16 staff which increased to 30 during the high season. 

We ran an M&A process after we were contacted by various prospective acquirers. In Q3 of 2022, the company was acquired by Zeus. The acquirer added Zwings' locations to their network of 45+ cities across Europe and Asia. In the year that followed the parent company's valuation doubled. 

I originally founded Zwings as a B2B SaaS electric transport solution provider for hotels and corporate offices. After COVID enforced lengthy stay-at-home orders and the hotel and commercial property markets were some of the worst affected, we had to quickly adapt. We made a successful pivot. We were able to onboard investors and skilled employees which helped us win and retain lucrative contracts. Our business model involved SaaS subscriptions and pay-as-you-go services. We built a streamlined operational model that involved a rotating team working 7 days a week around the clock to swap batteries in scooters and relocate vehicles for different geolocations relative to expected usage. 

We began receiving interest from various rivals and companies in the wider sector looking to acquire ZWINGS which led to our team initiating an M&A process. After a complex exit journey involving multiple bidders, Zwings was acquired for a deal comprising a combination of cash and equity. The M&A process was complex, drawn out and expensive and I have since met a lot of people that also experienced this with their exits. I learned a great deal scaling and exiting Zwings, both personally and professionally. Now, I am on a passion driven mission to drag the antiquated exit process into the digital age.

Founder and CEO (exited via M&A)

Urban Futures Podcast

I produced several podcast videos where I interviewed incredible leaders who are pioneering disruptive change in the transport and sustainability sectors and wider industries.

Founder and Host

Lektron Networks Power Controls

Between my second and final year at business school, I spent 2 months shadowing the founder of a renewable energy systems supplier. They specialise in electrical refurbishments inside hundreds of homes and offices across the south of England. I primarily supported the accounts team to help manage the company's finances. I gained a key insight into the mechanics behind reneweable energy and the wider cost and environmental impact of transitioning to greener systems.

Renewable Energy - Summer Accountant

CEO Foundy: sell & acquire £100k to £15m revenue businesses via Foundy.com's first of its kind AI powered acquisition portal | You no longer need 5 separate tools and 4 advisors, Foundy has all in one portal.

Warm Welcome! 👋 Considering selling or buying a company in the near or long term? Or maybe you want to help your community of business owners or buyers by referring them to Foundy.com and earning by doing so? Explore the links in my profile’s featured section to learn more.

1.) Business Sellers - Experienced advisory team + AI agents trained in historical acquisitions in your market to provide you the most optimal route to a successful acquisition

2. Business Buyers - Off market Deal origination and due diligence reports to find more deal flow and vet them more effectively. 

3.) Exited Founders -  Join our fast growing WhatsApp group for exited founders 

Deeper insights into our product:

1. **Industry-Leading AI**: This scans the entire internet to look for signals that indicate possible buyer interest for your business. We also centralise and streamline client’s growth and exit process, positioning you for the best exit deal.

2. **Specialist Advisors & Account Managers**: Our team collaborates with experts from each client’s market niche, providing tailored guidance and ensuring a seamless experience. 

We don’t compete with traditional advisors. Instead, we collaborate through a partner programme, sharing fees to tap into even the most niche buyer segments. Whether you're planning an exit soon or are already in the process, our tools, network, and advice can help you secure the best deal. Book a confidential call via our website or direct message me to give you free insights. 

**For Buyers:**  
Foundy.com offers buyers access to deal flow, networking events, due diligence tools, 1000 + lenders and educational resources to streamline sourcing and transactions. Meet M&A teams at publicly traded companies, exited founders, fund managers and acquisition entrepreneurs. 

**About Foundy.com** 
With over 14,000 self registered users, Foundy.com had modernised the M&A process. We used to operate a marketplace as our primary business model but we have learned that the best businesses don’t want to list on a marketplace, they want a specialist advisor that can empower them with the tools, knowledge, buyer network and support they need to successfully navigate the process. Our team includes M&A experts and seasoned entrepreneurs, all driven to modernise the M&A landscape on behalf of business owners across the UK, USA and beyond.

Let’s discuss your goals.  
[Book a Call: https://calendly.com/joe-7yw/30min?back=1&month=2024-03 

*(No recruiters, please)*

Foundy has overhauled the acquisition process for tech business sellers and acquirers. We are specialists in helping founders ready their business for an exit, including preparing their data room and finding relevant acquirers. Alternatively, founders and buyers can use our platform for free on a self-serve basis if they prefer. 

Buyer accounts include representatives of large tech companies, private equity and software aggregators as well as acquisition entrepreneurs and family offices. Sellers include founders of mostly profitable online businesses in verticals such as SaaS, fintech, mobile apps, marketplaces, eCommerce, Amazon FBA, Web3 and AI but we are very much open to hearing from companies in other sectors and industries, as well as distressed businesses. 

Alongside a range of digital tools and M&A advisory services, I am helping my team to produce podcasts, tutorials and blogs with the intention of delivering helpful insights and tips to company leaders, buyers and aspiring entrepreneurs on their journey to exit 💵

Join today by creating a free and anonymous account or sign up to our newsletter on https://app.foundy.com/sign-up

Joe Lewin

If you care about AI, this is today’s headline.

Disney just signed a 3-year licensing deal with OpenAI and is investing $1bn equity investment into the company.

Here’s what’s actually in the deal:

1. Users on Sora can generate short AI videos with 200+ characters from Disney, Marvel, Pixar and Star Wars
2. The best fan-inspired clips will appear on Disney+
3. OpenAI gets exclusive generative rights for year one
4. OpenAI cannot train its models on Disney IP
5. No real actor faces or voices, with heavy guardrails around that

The context is what makes this so big. A few months ago, Disney and other studios were blocking Sora and calling it a “significant legal risk.”

So, yesterday they were firing off copyright letters to other AI giants.
Now today they’re OpenAI’s first major content-licensing partner and a $1bn investor.

Disney CEO Bob Iger is already saying this is about licensed use and respecting creative work, not replacing it.

Sam Altman gets capital and a flagship Hollywood partner at a time when model-training costs are exploding.

So you end up with this:

Disney is hedging the future of its IP.

 OpenAI is clearing a legal and commercial path for Sora.

Together they’ve just drawn a blueprint for how AI and big IP might work together.

What do you see this as most: a smart copyright strategy, a lifeline for OpenAI, or the start of a new AI/ entertainment playbook?

Joe Lewin 

AI Native Route To Sell & Buy Companies | DealFlowAgent.com | Helping business owners & Acquirers find one another through conversational AI and navigate through to completion 3x faster

Big news for UK business owners today! 🚨

The proposed exit tax has been pulled from Friday’s Budget plans!

Credit to the 150 plus Startup Coalition signatories. A clear example of what aligned voices can achieve.

The U turn helps, but the initial message still lingers... The proposal for a 20 percent charge on unrealised gains unsettled founders, investors and acquirers across the UK.

Removing it was the right call. The UK cannot afford policies that discourage innovation or investment.

Recent signals people in the market have been talking about:

- founders exploring relocation conversations
- investors slowing deals due to uncertainty
- advisers flagging valuation volatility
- sentiment becoming as big a risk as the policy itself

These are signals, not predictions. But they show why policy clarity matters.

the UK is still a strong ecosystem! Global interest has not disappeared. It's still Europe's hub for innovation, for now, and the 3rd largest market for small cap M&A globally. 
 
YCombinator just release the first company for their winter cohort and it is a UK startup! Plus, we've just raised capital from US based investors. 

The proposal is off the table for this Budget. Now the question is whether confidence rebounds.

What is your take? Does this move restore confidence, or has the damage already been done?

Picture shows an image of the budget announcement with the red briefcase. 

Most founders waste months on buyers who were never serious.

You get an inbound from a potential acquirer. Spirits are high. 
First call booked.
They’re “keen.”

You share numbers. Share plans. Share hope.

Then it drags for weeks or months, unnecessarily.
More calls. More emails. Hidden intent. Then
Silence.
Or “new concerns.”
Or... they never had funding.

This is what happens when signals get lost.

The hard truth: buyer calls are broken.
Too polite (especially in the UK). Too vague.
Too easy for time-wasters.

So we changed it.

We’re building one of the largest, fastest-growing living relationship graphs of active acquirers through our conversational AI, Sterling. He optimises for the 'signal to noise' ratio

Users know his voice is AI but they seem to be building genuine rapport with human (business buyers, some are even hosting long and regular calls with him. 

Sterling surfaces what buyers truly want, what they’ll never touch, and how serious they really are.

No one can fake that.
Time-wasters show in minutes, not months.

I’ve watched founders burn out chasing tyre-kickers.
Now deals move faster because buyers put their cards on the table early.

You can’t scale trust with hope.
You can scale insight with the right questions, asked early.

Want to see how Sterling separates real buyers from the rest?
Comment INSIGHT and I’ll share a high-level framework

thank you Timothy Armoo! Our buy side conversational AI is seeing a serious surge in interest in local service niches, including property services and healthcare. 

Our friendly AI agent, Sterling, is hosting human like conversations with buyers to hear about their nuance search criteria so that we can make warm intro's, where they can, to qualified deal flow. 

(think Boardy.ai or Jack & Jill but specifically for connecting buyers and sellers for small cap M&A.)

Dental, HVAC, Plumbing, Electricians, Emergency Services... and other future proof niches - all moving.

buyers are actively looking for profitable, healthy businesses in the 1-10 million revenue range with recurring revenue models and local defensibility.

if you're a business owner considering a move, whether retiring or moving to your next project, or a business buyer, let's chat.

Join The UK’s Biggest Live Event On January 10th In My Featured Section ⬇️

These businesses will never trend on Twitter.

But they make more than 99% of start-ups.

Everyone's chasing the next AI startup while plumbers are quietly banking £2M a year.
These businesses are insane, and often overlooked.

The pattern is obvious:

- Local service roll-ups
- Boring B2B software
- Unsexy recurring revenue
- Infrastructure nobody thinks about

Steal these business ideas before everyone else catches on. 👇


P.S. If you have a business and you’re thinking of selling in the next 6-24 months, I’ve got something for you. At DealFlowAgent, we help you strategise the path to your exit to get you the best price possible. Send me a message if you want to know more.

These 7 Boring Businesses Make Stupid Money

Tag a trusted operator or thought leader in either property services or healthcare – dinner on us.

Who are the well-respected people across these two verticals and sub-niches?

🏘 Property services: pest control, HVAC, roofing, landscaping, fire safety, solar, electricians, plumbing and data centres etc.

🏥 Healthcare: dental clinics, care homes, outpatient centres, vets etc.

Tag any of the following in the comments below:

 ✓ Service provider or operator
 ✓ Journalist or blogger in these sectors
 ✓ Thought leader on LinkedIn or Meta
 ✓ Anyone else with a strong network of business owners in these niches

If someone you tag ends up partnering with us, we’ll send both of you a dinner gift card for two, as a thank-you. 

Know someone who fits this? Tag them in the comments below.

If they might be in your network, a like or repost helps this reach the right people and might unlock a life-changing opportunity for them.

If that’s you, let’s talk.

The biggest discount on your exit rarely happens on paper. It happens in the first few conversations.

If you do not control the story early, you lose leverage in price and terms.

Preparation is clarity. Contracts, margins, team, and tidy process.

We help owners tighten that story and meet only serious, funded buyers.

I put together a private Home Services Exit Pack

Story Sheet, Buyer Question Set, Contract Visibility template, and the UK and US proof stacks on one page.

Using this pack helps owners tighten the story, reduce buyer pushback, and improve leverage in real negotiations.

Direct message me 'HS-Exit' and I will send it privately.


#HVAC #firesafety #pestcontrol #drainage #electrician #HomeServices #BusinessSale #MergersAndAcquisitions #ExitPlanning #DealFlowAgent

How to sell your home services business

Aikido Security

Building the next 🇧🇪 🇪🇺 🦄. Join us!

Aikido is a dev-friendly software security platform. Used by CTOs, CISOs and dev teams such as Niantic, Soundcloud, n8n, LexisNexis, Visma, Cabinet Office, Mont Blanc, GoCardless and 1k+ more.

Code-to-cloud scanning done 15+ different ways. Catch 85% of your false positives. Devs spend less time triaging, more time shipping.

Get started for free: https://app.aikido.dev/. No strings attached.

Raised $25 mil <18 months since inception. Backed by Singular VC, Notion Capital, Connect Ventures, Vanta's CEO and Google's ex-CFO.

Sales performance:
- Highest billing rep in FY25 (to date)
- First rep ever to hit €1M+ in net new/expansion ARR
- Consistent sales team over-performance each quarter
- Results vs target: Q1 164%, Q2 147%, Q3 144%

VP Revenue - EMEA & APAC

- Joined at <10 employees, <$250k ARR
- First remote sales hire for Aikido
- Worked with founders & team to grow to $5M+ ARR within 12 months
- Supported all major aspects of GTM growth (hiring, prospecting, playbooks, coaching)
- Ran multiple events, conferences and partner sales to lay ground work for FY25+ growth
- Highest billing rep in FY24 (Results vs target: Q1 96%, Q2 115%, Q3 66%, 211%)

Revenue Lead - UKI & Global Sales

Filtered

Learning tech for over 1m global users at companies like: P&G, AstraZeneca, GSK, Novartis, Danone, Novo Nordisk, Shell, the NHS, and many more.

By using the data you already have, combined with our human- and AI-powered technology, we filter out wasted learning spend and crappy content, help personalize learning to your organization's actual needs, and amplify that across your entire workforce.

Our customers realize real $$$ savings from day 1 (up to 50%), 10x faster curation, and significantly better LXP and LMS experiences. And we're bloody good at it!

Co-Founder

- Taking over a CS function of zero CSMs as we pivoted our business to a new category
- Running all AM duties across 30+ enterprise accounts and taking on full quota responsibility (£MMs)
- Planning account mapping, expansions, renewals, territory management & full cycle revenue mgt
- FY22 results (to quota): Q1 105%, Q2 122% (2nd highest booking period in the company's 13+ year history; remaining top five periods also under my stewardship (FY20/21))
- Within 6 months, re-established CSM function by evolving the careers of our IMs into CSMs
- 100% logo retention of new product; 95% logo retention of legacy product; 135%+ NRR
- New & improved processes across: sales handoffs; pricing models; professional services; customer & MI reporting; product feedback; sales intelligence; account management

Co-founder & Chief Customer Officer

- FY20/21: Oversaw CS function; team achieved 120% to quota (unrevised during covid): Q1 97%, Q2 140%, Q3 126%, Q4 104% (including the top 4/5 quarters by bookings in the company's 13+ year history)
- Retained all major logos, and creatively upsold through new products, features, licences and partnerships; setting up the business to successfully pivot to a new product/sub-category in FY21
- Sold into blue-chip organisations by multi-threading C-level execs and securing company’s largest ever multi-year contract £MM+
- Developed pipeline to support new logo acquisition in FY21
- Grew both functions 3x and created a progression framework to attract, retain and develop staff
- Implemented executive, sales and customer training programmes, reading groups and sales frameworks to build an optimal CS and ops function
- Setup systems to proactively monitor under-utilised accounts, user engagement or new corporate initiatives for cross/upsell opportunities
- Oversaw ops & CS functions during covid and stabilised cashflows through revenue growth and refinancing (renegotiated contracts, payment terms and Innovate Grant/Loan funding)

Co-founder & COO

- Co-led (with CEO) on corporate strategy to secure company’s first rounds of seed funding in both equity and convertible notes (Jan 2016-Jun 2018)
- Created new workflows to support an evolving team as we pivoted to B2B-enterprise sales and developed an AI-based LXP; first-to-market with learning recommendations
- Acquired new B2B enterprise logos (2017) and built post-sales infrastructure to support these early customers (2018)
- Won a place for Filtered on Startup 500’s founder bootcamp in SF (Sep 2018)
- Secured and led on loan financing (Dec 2018) and then series A (Jul 2019); taking total funding to date $5m+

Co-founder & Head of Operations

Travelled around SE Asia, New Zealand and the US

Co-founder & Director (on sabbatical)

- Created and launched from scratch a brand-new B2B brand (Filtered) to take our B2C off-the-shelf library success into large corporate businesses
- Oversaw all ops, marketing and product/engineering functions, introducing new processes such as Agile, scrum, hifi/lofi prototyping, and emerging technologies such as Hubspot marketing/CRM, Customer.io, Heal, Algolia and many others
- Led on establishing the company’s first recurring revenue base of customers, going from £0 to £600k ARR in <6 months, and minimal acquisition/expansion spend

Co-founder & Head of Product

- Prototyped and innovated a novel approach to algorithmic, adaptive online learning, US-patent approved algorithm: "Computer systems and computer-implemented methods for providing training content to a user"; United States No 14/540395.
- First-to-market online training courses through daily deal sites, growing revenues from $0 to $5m+ in <24 months building a profitable, bootstrapped startup
- Launched multilingual, global products across all time zones, setup CS, support, finance, ops/people functions from scratch, growing team from three founders to 35+ staff in <18 months

Co-founder

The Revenue Syndicate is Europe’s first investment community and angel investment syndicate built for go-to-market operators in the European tech industry. Our 500+ exclusive members are some of the best go-to-market practitioners in Europe and are driving the growth of the fastest growing companies in the world.

Investor

Replicate Labs

Replicate helps sales teams understand their buyers better.

Instead of using outdated personas, Replicate creates dynamic, real-time personas that evolve with new data from LinkedIn, podcasts, calls, and emails. You can view these personas to see how they change, interact with them for research and feedback, or role-play any sales scenario to practice and get targeted coaching.

With powerful analytics to see if using these personas lead to real-world improvements in sales behaviour and business impact.

Backed by Emerge Education, Revenue Syndicate, SFC Capital and Al Newman. Official partners of ValueSelling Associates and Salesloft.

Odin

Odin is building a better way to invest together. Our first product is a relationship-focused, community-centric investment marketplace, which gives you access to the best private markets investments and allows more people to participate in building the future.

Find out why thousands of other business buyers and founders use Foundy for a streamlined, transparent acquisition process. Sell your business via Foundy's end-to-end platform

Honest Mobile

Changing Mobile for Good. Good for you. Good for the planet.

Uhubs

On a mission to enable 1 billion people realise their potential by 2030. We started by improving the performance of Sales and Marketing teams.

Flexa

Led and built a revenue function which hit record-breaking months and quarters, acquired a flurry of MM and enterprise logos and established itself as a recognised player in the Employer Branding space.

New logos acquired include: Microsoft, Mondelez (owners of Cadbury's), TUI, Centrica, MoneySuperMarket, Trainline, Not On The High Street, Motorway and 50+ others.

Highlights & results include:

- Results: Achieved 2.5x ARR growth in 9 months
- ACV: 10x growth from £1.5k to £15k (inc 3x largest deals)
- New logos: 55+ new logos acquired, inc 5x enterprise
- Retention: 125% NRR and 100% GRR (Tier 1 logos)
- Satisfaction: Achieved 4.8/5* on G2 in <3 months (no prior presence)
- ICP: Evolved our value prop to accelerate our up-market motion (from VSBs to MM and Enterprise)
- Team: Setting up a revenue function of SDRs, AEs, CSMs & AMs, with career progression plans

- Stack: Fully setup Hubspot CRM & Marketing, Apollo.io and Gong in <3 weeks
- Process: Pipeline reviews, SPICED sales framework, deal management, deal desks and new contracts
- Customer Success: Established Time-To-Value metrics & monitoring, implemented a proactive programme of "always-on" customer marketing, case studies and testimonials via our CSMs
- Commissions: Created new quotas and commissions schemes for all roles in the function
- Marketing: Ran mixed format events, including first industry conference (10x cost outlay recovered through 3x new deals within 3 months)
- IC contribution: Led from the front, ran my own deals and carried my own quota

Chief Revenue Officer

âcasă - your home run

Financial management platform for the home. Invested at seed stage.

Experienced startup operator, investor and advisor on all things revenue and GTM.

Hired 300+ people over the years, created startups that have grown to £MM's in recurring revenue, and led teams of all sizes at the startup - series B phases.

I'm in my comfort zone when I'm working in high-performing and high-trust teams, where we expend the effort to go and visit our customers, understand their worlds and do our best to help them. I'm a deeply empathetic leader who invests a lot of time in my teams. Whether it's working as an SDR, AE, CSM or AM, or the wider organisation, I always lead from the front. And let my teams grow and develop.

Also an angel (seed) investor in a range of UK startups (solo seed and via syndicate) & Venture Fellow on the Newton Venture Program (LBS, LocalGlobe).

Vinit Patel

Two years ago I shot my shot. 🏀 🏀 🏀

I got two separate investor mailshots (Notion Capital and Connect Ventures) in the space of two weeks about how they'd bankrolled a $5m seed round into a tinnyyyyy ass Belgian startup with 6 people in it.

These were two funds I'd tried to raise from for years and had no luck!

And on top of that some super angels like Christina Cacioppo (Vanta CEO) + former Google and Deliveroo execs + others also participated.

I was like:
"who the hell are these Aikido guys?"
"how da f did they do that in <1 year?"
"i need to be a part of this!"

10 mins later I sent this email.
A few mins after that, I got an immediate response.
Damn these guys were fast.
My kinda people.

We spoke.
I did a mock demo.
And had to learn about this thing called "application security".
FAST.

And the rest is history.

I joined at <$250k ARR.
We're now at $XXm+ ARR and growing fast.

Team has grown from 6 to 160.
We'll touch 200 soon.

From the 160.
About 20 of us are ex-founders with something to prove!

The best part:

Our founders (Willem, Roeland, Felix) are just as obsessed as at day 1

Our team is just obsessed about delighting ALL customers (big or small) as if they’re our first.

We’re fortunate to count the likes of Revolut, n8n, Visma, Niantic, Inc., GoCardless, Allica Bank, ClearBank, Montblanc, SoundCloud and nearly 2k+ others as customers (1,800 of them joined in last 2 years alone).

We have many open roles across entire biz.

Meet my friend Jarno Broodcoorens: at aikido.dev/meetjarno

We’ve only just started!

Aikido Security. 

PS - lol, I love a PS. Even bigger news dropping soon. Watch this space.

Vinit Patel 🛡️

No bullsh*t security for devs 🛡️ | Rev Leader @ Aikido | Recovering Founder | Investor

you just need this:

"Safe-chain: Exiting without installing malicious package"

the second you try to pre-install a malicious package from NPM

you are IMMEDIATELY blocked. ❌ 
no ifs, no buts.

and every dev can run Safe Chain for FREE. completely free.
no ifs, no buts.

if you're not using Safe Chain, you're exposing yourself to a serious attack vector for no upside. all downside.

still not convinced?

go read what we discovered today at Aikido Security and which affected c. 500 packages / 100 millions monthly downloads

including from some reputable, first-class maintainers including Zapier, ENS, AsyncAPI, PostHog, Browserbase, and Postman

Read more here: https://lnkd.in/ea9f6Exf

Install Safe Chain now (yes, $0 forever!): https://lnkd.in/eZrRahs6

Malware detection is a race against time. Be first OR be good.

When we're first = we publish, inform & spread the word. Fast.

When we're not = we follow, we support, we help. Generously.

We're proud of our amazing research team. Unsung heroes!

Kudos to Wiz and StepSecurity who did reach out to confirm and credit our research & researchers.

Important point here is that...

Sha1-Hulud Strikes Again was confirmed by Aikido Security on Nov 24th 03:16:26 (GMT+0).

If you found it before us - tell us, and share the evidence.

If you didn't - join us in informing others and give us credit for it.

Our Malware Intel feed runs on 5m+ popular packages EVERY DAY and we notice weirddddd sh*t all day long:

⚠️ Intentionally malicious by design. Packages deliberately created to steal data or compromise systems

🔡 Typosquatting. Malicious packages with names similar to popular legitimate packages

🐍 Dependency Poisoning. Injecting malicious code into legitimate package dependencies

🔥 Compromised Accounts. Attackers gain access to legitimate maintainer accounts to push malicious updates.

💩 Dodgy updates. Previously safe packages that introduce malicious code in later versions

We scan, triage and notify these with manual, human research every day
Today was a full on day for our brilliant research & eng team

And it's ONLY one of 15+ core capabilities of ours at Aikido Security

I'm damn proud of our team who do all this and more.

You can also block all this nasty stuff with Safe Chain!
(completely free for you to use)

https://lnkd.in/e7qpQNYd

====

Less impressed when others that just post as if they found it without even mentioning the original researcher. Not even once. Anywhere.

Open article: Aikido Intel- Open Source Threat Intelligence by intel.aikido.dev

Aikido Intel- Open Source Threat Intelligence

We compete with some of these BUT
We also ALL wanna stop the baddies too!

Huge shout out to the incredible researchers and teams at the below (and more).

This is an exceptional community! Round up:

Aikido Security > https://lnkd.in/ea9f6Exf

Wiz > https://lnkd.in/ekf2hB3V

Snyk > https://lnkd.in/ebvPsfsy

GitGuardian > https://lnkd.in/eVsDqeCF

Datadog > https://lnkd.in/eESADC-G

Sonatype > https://lnkd.in/ect5n-UR

Sola Security > https://lnkd.in/eGjUDwvz

Harness > https://lnkd.in/ekzSSSCM

Endor Labs > https://lnkd.in/eq6Tninr

Upwind Security > https://lnkd.in/eDrUf7V4

And of course always wrap your npm pre-installs with Safe Chain

https://lnkd.in/eZrRahs6

New vuln in your dev AI agents found by Aikido Security

If you're a dev building with Claude Code (Anthropic), Codex (OpenAI), Gemini (Google) or AI Inference (GitHub) then read this.

Attackers can submit crafted issues/PRs that trick the AI into executing privileged GitHub CLI commands- leaking secrets or modifying CI/CD workflows.

⚠️ 🚨 Introducing PromptPwnd: A new vulnerability class affecting AI agents in GitHub Actions

What we found:

 • Confirmed exposure in FIVE Fortune 500 companies
 • Google’s Gemini CLI repository was also impacted (now fixed)
 • Vulnerability pattern is already present in real-world workflows
 • Likely affects many more organisations using AI agents in CI/CDIf you use AI agents in GitHub Actions/GitLab CI/CD check your pipelines immediately.

Recommendations:
1/ Remove or restrict privileged tools available to AI agents
2/ Never send untrusted PR/issue content directly into AI prompts
3/ Treat AI-generated output as untrusted code
4/ Limit the blast radius of GitHub tokens (IP-restricted tokens recommended)

👉 How to check if you are affected:
1) Scan your GitHub Action files using Opengrep (Aikido provides rules: https://lnkd.in/dnrEqjdM)

2) Use Aikido Security, which automatically identifies unsafe AI prompt flows in the free tier

Full research by Rein Daelman is here: https://lnkd.in/ehkkvF9U

Open article: Prompt Injection Inside GitHub Actions: The New Frontier of Supply Chain Attacks by aikido.dev

Prompt Injection Inside GitHub Actions: The New Frontier of Supply Chain Attacks

Zapier NPM account is compromised, see details below. 

About 16k (and counting) packages are affected.

Always use Aikido Security's completely free/OSS Safe Chain as an npm wrapper

https://lnkd.in/eZrRahs6

Developer and Security Advocate @ Aikido Security

🚨ZAPIER SUPPLY CHAIN COMPROMISE ALERT

In the latest episode of “Please Stop Breaking the Internet,” Aikido Security has just detected Zapier's NPM account has been compromised & multiple packages have been infected with Malware by the same actors behind the Shai Hulud self-propagating worm discovered in September. 

So far 16k+ public Repositories have been created on GitHub containing stolen credentials under the name "Sha1-Hulud: The Second Coming"

Zapier packages include:
zapier-platform-core
zapier-platform-cli
zapier-platform-schema
@zapier/secret-scrubber

The same malware was infected in the ENS ecosystem as well
@ensdomains/ens-validation
@ensdomains/content-hash
ethereum-ens
@ensdomains/react-ens-address
@ensdomains/ens-contracts
@ensdomains/ensjs
@ensdomains/ens-archived-contracts
@ensdomains/dnssecoraclejs

What’s going on?
 The same threat actor behind the Shai Hulud malware has pivoted to new targets, injecting malicious code into these packages. The intent is familiar: steal credentials, exfiltrate sensitive data, and generally ruin everyone’s Monday. 

What you should do now:
Check which versions you depend on.
Rotate secrets if you consumed the affected packages.
Pin trusted versions & enable package integrity tooling.
Use tools like Safe-Chain to prevent install malicious packages. 

This is an unfolding situation, I will provide more details as they unfold in comments including a technical blog.

taplio

The Battle

Joe Lewin

Vinit Patel

Followers

Posts

Engagements

Likes

Performance ScoreJoe Lewin's LinkedIn Performance

Performance ScoreVinit Patel's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Joe Lewin

Vinit Patel

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Joe Lewin's LinkedIn Performance

Performance ScoreVinit Patel's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreJoe Lewin's LinkedIn Performance