A new variant of the Miasma worm has been discovered exploiting npm's binding.gyp build file to execute malicious code during package installation, bypassing traditional package.json script audits. Th…
The Miasma software supply chain attack toolkit has been released as open source across multiple GitHub repositories, likely through compromised developer accounts. The toolkit enables attackers to ex…
Socket Threat Research identified 23 new malicious PyPI packages in the Mini Shai-Hulud, Miasma, and Hades supply chain attacks, targeting bioinformatics and AI/MCP developers with trojanized native e…
Socket detected a coordinated PyPI compromise involving 37 malicious wheel artifacts across 19 packages, part of the Shai-Hulud/Miasma campaign that uses Python startup execution to download Bun and r…
Jhansi.io v0.3 introduces persistent dependency management for AI-generated code, eliminating the need for manual package installation in cloud sandboxes. The update automatically installs dependencie…
Thinking Machines Lab released two open-source libraries, `tinker` and `tinker-cookbook`, to help developers and researchers fine-tune large language models. The `tinker` SDK handles distributed train…
A new malware campaign dubbed 'Miasma' is spreading through IDE configuration settings, AI-assisted environments, and multiple package manager ecosystems, marking what researchers believe is the first…
A developer has released Cli Modelarium, an open-source command-line tool that enables statistically rigorous LLM comparisons directly from the terminal. The tool, available on PyPI under Apache 2.0, …
A developer built **Agent_Sudo**, a local permission gateway for AI agents that enforces allow/deny/approval policies and generates tamper-evident audit logs, publishing it to PyPI as v0.4.0 with ~190…
The developer behind .klickd has released version 4.1 of the portable, encrypted memory system for AI workflows, addressing the problem of disposable memory that resets between sessions. The open-sour…
Developer Matt Coles has built lgtmaybe, a provider-agnostic PR reviewer supporting six model backends with a single --provider flag, shipping as a PyPI CLI and GitHub Action. He also maintains a home…
The Sovereign SDK version 1.0.1 has been released on PyPI as a Python-native framework that eliminates conversational overhead in AI agent communications while generating cryptographic forensic receip…
Perplexity launched Bumblebee, an open-source read-only scanner that checks developer machines for risky packages, extensions, and AI tool configurations during supply-chain incidents. The tool, avail…
A developer expanded their AI-agent security benchmark from 10 to 16 scenarios, revealing that Claude Code Sonnet 4.6 scores +9 out of 16 while Haiku 4.5 scores only +3. The original tie between the t…
A cybersecurity prediction log forecasts a wave of low-skill attackers exploiting CI/CD configuration files (GitHub Actions, GitLab CI, CircleCI) at scale, beginning in Q3 2026. The prediction disting…
The article introduces **django-deploy-probes**, a small Django package that provides standardized health check endpoints (`/healthz`, `/readyz`, `/startupz`, `/version`) for production deployment wor…
Perplexity released Bumblebee, an open-source security scanner for macOS and Linux that detects risky packages, browser extensions, editor extensions, and AI tool configurations in local developer env…
The article introduces **llm-nano-vm v0.8.0**, a deterministic Finite State Machine (FSM) runtime for LLM pipelines that flips the typical architecture by making the runtime the orchestrator rather th…
Agentra is an open-source enterprise AI engineering control plane designed to manage and secure AI coding agents like Cursor, Claude, and Copilot. It sits between developers and coding agents to enfor…
Agentleash, a lightweight Python guardrail library (~280 lines) designed to enforce safety controls on LLM agents like Hermes Agent by intercepting tool calls at the function boundary. It implements f…