MacOS automation setup using two launchd plist files and two shell scripts to perform daily system updates and hourly cleanup tasks. The daily-update script updates Homebrew, npm, and various develope…
In October 2021, the popular npm package `ua-parser-js`—used by major companies like Facebook and Google with 7 million weekly downloads—had no reported vulnerabilities and clean code, but its maintai…
Supply chain attacks on npm and GitHub Actions are exploiting the gap between malicious package publication and CVE issuance, with attackers publishing compromised versions that are installed by thous…
According to a May 22, 2026 update, the MCP ecosystem has expanded significantly, evolving from a protocol into a standard method for granting AI models access to tools like databases and APIs. Howeve…
On May 18, 2026, Shopify released @shopify/ucp-cli, an open-source command-line tool and MCP server that functions as an AI shopping agent powered by the Universal Commerce Protocol (UCP). The CLI con…
Nine malicious npm packages impersonating Polymarket trading tools were published on May 20, 2026, by the account "polymarketdev," stealing cryptocurrency wallet private keys upon installation. The pa…
On May 11, 2024, TanStack suffered a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious versions within six minutes. The attackers exploited GitHub Actions c…
Seed4j-mcp is a new open-source Model Context Protocol (MCP) server that allows AI agents like Claude Code and Cursor to control the seed4j application generator, enabling them to scaffold Spring Boot…
Three versions of the widely used npm package node-ipc (9.1.6, 9.2.3, and 12.0.1) were compromised on May 14, 2026, after an attacker took over the co-maintainer account "atiertant" and published mali…
Five typosquatting npm packages published by accounts named "superbase" and "micresoft" contain a hidden 4.5 MB ELF binary that executes automatically upon `npm install` and, through a hijacked `Sessi…
On May 11, 2026, an attacker compromised the TanStack Router/Start repository and published 84 malicious npm package versions across 42 packages by exploiting a pull_request_target vulnerability, GitH…
A malicious npm package named "exiouss" was published on May 1, 2026, by the account "loltestpad" as a rebranded version of the previously removed "godsplan" package, now bundling a PowerShell script …
The PyTorch Lightning deep-learning framework was compromised on PyPI, with versions 2.6.2 and 2.6.3 containing a credential-stealing worm called Shai-Hulud. The malware activates when Python code run…
Setting a minimum release age (cooldown) on dependencies is a low-effort, high-impact defense against supply-chain attacks, as most malicious packages are detected and removed within hours. All three …
The article describes an uninstall script for the Beads (bd) tool that performs a comprehensive cleanup of all its traces from a system. By default, the script runs in dry-run mode to show what would …
Deno 2.6 introduces a new tool called `dx`, which functions as an equivalent to `npx` for conveniently running binaries from npm and JSR packages. The release also adds more granular permission contro…
The article explains that Node.js and npm have a permissive default security model, allowing any installed package code, including malicious scripts, full system access. In contrast, Deno is designed …
The article explains that Bun's package installation is significantly faster than other Node.js package managers because it treats installation as a systems programming problem rather than a JavaScrip…
The article describes "Typosquat Detective," a short online game designed to train users to identify look-alike domains used in phishing attacks. The game tests players on spotting tricks like number-…
The Hex team has launched **diff.hex.pm**, a free web-based tool that generates highlighted git diffs for any Hex package version range directly in a browser. Designed to improve supply chain security…