Attackers are increasingly targeting developer endpoints to steal credentials, as demonstrated by supply chain attacks like Megalodon, TrapDoor, and Miasma. GitGuardian's new Developer Endpoint Protec…
A developer built a Docker MCP server with 50 tools after finding 11 existing packages fragmented across different licenses and feature sets. The server, which has achieved over 3,042 weekly downloads…
In June 2026, attackers hijacked the npm contributor account 'ehindero' to mass-publish malicious versions of 144 packages under the @mastra namespace, in what security researchers from JFrog, SafeDep…
An attacker hijacked a dormant contributor account and published malicious versions of 144 packages under the @mastra npm scope between 01:15 and 02:36 UTC, targeting the TypeScript AI agent framework…
On June 17, 2026, an attacker compromised the @mastra npm organization and added the typosquat package easy-day-js as a dependency across 140+ Mastra AI framework packages, exposing over 1.1 million w…
A supply chain attack compromised over 140 npm packages in the @mastra scope, including @mastra/core with 918K weekly downloads, by injecting a malicious dependency that executes a postinstall script …
The StepSecurity Threat Intelligence Team has identified that multiple @mastra npm packages have been compromised. The security breach was disclosed in a GitHub issue on the mastra-ai/mastra repositor…
Socket Threat Research identified shai_hulululud@1.0.48596, an npm package designed to probe AI-based malware scanners using prompt injection, token flooding, and obfuscated JavaScript. The package co…
Developer released Pacwich, a lightweight monorepo tool that works with Bun, npm, or pnpm, replacing the earlier bun-workspaces package. The tool requires zero configuration and uses plain package.jso…
Muster 1.0.0, a new CLI tool from developer Garrison, tests AI agent stacks across seven layers including persona, skills, SOP, tools, memory, heartbeat, and A2A. It performs both static validation an…
JerrySniffs launched an MCP server and API suite for web and social media search, offering credit-based access to Google, Twitter/X, Reddit, and page-to-markdown endpoints with no recurring subscripti…
Microsoft's platform teams discovered that AI coding agents ignore new CLI tools and default to older, more documented predecessors due to training data gravity, even when explicitly instructed otherw…
A developer built RagScope, an open-source tool that audits RAG pipelines to reveal wasted retrieval latency from chunks fetched but never used in the final prompt. The tool uses OpenTelemetry traces …
GitHits launched its public beta 0.9, a CLI and local MCP server that gives coding agents access to open-source code behind project dependencies. The tool indexes open-source code and documentation, a…
A developer released Pi, a coding agent that runs entirely on a local machine without API keys or cloud dependencies. Pi works with a local llama.cpp server hosting Google Gemma 4 models, enabling off…
A developer received a LinkedIn message from a recruiter at a crypto startup asking to review a GitHub repository before a technical interview. The repository contained a backdoor in npm's prepare scr…
A developer released cPanel MCP, a tool enabling AI agents to administer cPanel servers via WHM and UAPI, on npmjs.com. The tool dynamically probes server versions to avoid documentation drift and has…
A high school student in Italy built TITAN (Token Intelligence Through Agent Narrowing), a zero-dependency CLI framework that compresses AI coding agent token consumption by 70% to 85% without degradi…
A security researcher received a LinkedIn message from a recruiter at a crypto startup asking them to review a GitHub repo. The repo contained a backdoor that would execute arbitrary code when depende…
A developer analyzed Google Search Console data for their indie tool Mimi Seed and found that optimizing for generative engine optimization (GEO) is effectively just traditional SEO. The real issue wa…