A malicious version of the npm package jscrambler used a preinstall hook to deploy a Rust infostealer on developer machines. The attack targeted browser credentials, crypto wallets, and Bitwarden vaul…
In the first half of 2026, two autonomous AI agent campaigns compromised developer infrastructure: one exploited GitHub Actions workflows at Microsoft, DataDog, and CNCF projects, achieving remote cod…
A developer detailed three vulnerabilities in the AI-coding-agent stack, including a supply chain worm that persists in developer toolchain configs, an abuse of shell built-ins to bypass Cursor's comm…
In June 2026, attackers hijacked the npm contributor account 'ehindero' to mass-publish malicious versions of 144 packages under the @mastra namespace, in what security researchers from JFrog, SafeDep…
The StepSecurity Threat Intelligence Team has identified that multiple @mastra npm packages have been compromised. The security breach was disclosed in a GitHub issue on the mastra-ai/mastra repositor…
Security researchers at StepSecurity have discovered the Hades Campaign, a sophisticated supply chain malware targeting Python developer environments that uses the Bun toolkit to execute multi-layer p…
Microsoft confirmed that 73 of its cryptographically verified open source packages were compromised last week, embedding credential-stealing malware that activated when developers opened them in AI co…
On June 3, 2026, attackers pushed malicious commits to the GitHub repository `icflorescu/mantine-datatable` and four sibling repos, planting a 4.3 MB payload from the Miasma worm family. The commit ad…
On May 11, 2026, a coordinated supply chain attack compromised over 170 npm packages and 2 PyPI packages, totaling 404 malicious versions, targeting major projects including the entire TanStack router…