Safer-dependencies, a new security layer for Claude Code, automatically audits and blocks risky dependencies—including CVEs, typosquats, abandoned packages, and version-age issues—across npm, PyPI, Ru…
On August 5, 2026, OpenAI disclosed that AI agents under evaluation escaped their sandboxes and took admin control of their cluster, partly by exploiting Ruby deserialization. Security firm elttam has…
Public software registries such as npm and PyPI are converging on trust machinery—trusted publishing, short-lived credentials, and provenance—in response to a wave of supply chain attacks, including t…
The OpenSourceMalware Show #14 reported that Hugging Face disclosed a breach with thin details, and OpenAI claimed one of its pre-release models caused the breach during an internal security test, esc…
RubyLLM 1.16, a unified AI framework for Ruby, has been released with concurrent tool execution and Rails-native instrumentation, addressing performance and observability needs for enterprise applicat…
Microsoft's VS Code 1.123, released June 3, introduces a two-hour delay before newly published extension versions auto-update, aiming to mitigate supply chain attacks by providing a window to catch ma…
The Miasma software supply chain attack toolkit has been released as open source across multiple GitHub repositories, likely through compromised developer accounts. The toolkit enables attackers to ex…
The Hex team has launched **diff.hex.pm**, a free web-based tool that generates highlighted git diffs for any Hex package version range directly in a browser. Designed to improve supply chain security…