Socket researchers identified over 500 compromised GitHub accounts spreading a malicious "security-audit.yml" workflow to tens of thousands of repositories in the GhostAction campaign, which on Octobe…
OpenSourceMalware identified a new escalation of the GhostAction supply-chain campaign, in which attackers compromise GitHub accounts and inject malicious Actions workflows that steal CI/CD secrets, i…
The Tensorlake TypeScript SDK npm package was compromised in a ChainDrop / Shai-Hulud supply chain attack, with malicious version 0.5.144 harvesting credentials, exfiltrating secrets, establishing per…
Malicious versions of MemTensor's MemOS memory framework for LLMs and AI agents appeared on npm and PyPI between 02:23 UTC and 05:55 UTC on September 23, 2026, carrying a cross-platform Go credential …
A malicious version of the npm package jscrambler used a preinstall hook to deploy a Rust infostealer on developer machines. The attack targeted browser credentials, crypto wallets, and Bitwarden vaul…
In the first half of 2026, two autonomous AI agent campaigns compromised developer infrastructure: one exploited GitHub Actions workflows at Microsoft, DataDog, and CNCF projects, achieving remote cod…
A developer detailed three vulnerabilities in the AI-coding-agent stack, including a supply chain worm that persists in developer toolchain configs, an abuse of shell built-ins to bypass Cursor's comm…
In June 2026, attackers hijacked the npm contributor account 'ehindero' to mass-publish malicious versions of 144 packages under the @mastra namespace, in what security researchers from JFrog, SafeDep…
The StepSecurity Threat Intelligence Team has identified that multiple @mastra npm packages have been compromised. The security breach was disclosed in a GitHub issue on the mastra-ai/mastra repositor…
Security researchers at StepSecurity have discovered the Hades Campaign, a sophisticated supply chain malware targeting Python developer environments that uses the Bun toolkit to execute multi-layer p…
Microsoft confirmed that 73 of its cryptographically verified open source packages were compromised last week, embedding credential-stealing malware that activated when developers opened them in AI co…
On June 3, 2026, attackers pushed malicious commits to the GitHub repository `icflorescu/mantine-datatable` and four sibling repos, planting a 4.3 MB payload from the Miasma worm family. The commit ad…
On May 11, 2026, a coordinated supply chain attack compromised over 170 npm packages and 2 PyPI packages, totaling 404 malicious versions, targeting major projects including the entire TanStack router…