Two distinct types of knowledge—procedural (skills) and declarative (facts)—must be formalized separately for AI agents, with skills distributed via package managers like apt and declarative knowledge…
Meta has open-sourced Astryx, a design system used internally for eight years that powers over 13,000 apps. The system provides 90+ accessible, themeable React components and is designed for both huma…
Microsoft Threat Intelligence reported that North Korean state-sponsored actor Sapphire Sleet compromised over 140 packages in the @mastra npm scope, targeting developers building AI coding tools. The…
Developer l-zhi released Pith, a local-first desktop LLM wiki that ingests notes, PDFs, and emails into Markdown entries without using vector databases or embeddings, relying instead on keyword search…
A Miasma worm variant infected 20 npm packages under the LeoPlatform organization on June 24, 2026, after an attacker compromised a single maintainer's tokens. The malicious payload, a polymorphic cre…
A developer warns that monorepos, while centralizing multiple packages and services, create a security blind spot because a single repository can contain many different dependency trees with varying r…
A supply-chain attack on the @mastra AI-agent ecosystem saw an attacker republish 141 packages with a malicious dependency that targeted crypto wallets. The incident highlights how AI coding tools lik…
A developer documented workarounds for breaking changes in Anthropic's Claude Code CLI tool, including pinning version 1.0.17, disabling auto-updates, and patching the `exit_plan_mode` popup to preven…
A developer created leak_probe.py, an 80-line Python tool that checks which secrets actually ship in an npm package versus those found in the git repository. Testing showed 6 secret hits in the repo b…
A developer warns that AI coding agents like Claude Code, Cursor, and Copilot generate tech debt by confidently guessing dependencies from frozen training data, unable to consider internal libraries, …
Figma announced code layers and AI plugin tools at Config 2026, enabling teams to clone repositories, convert components into editable code-backed layers, and build custom plugins via text prompts. Th…
Four projects share the name 'SkillsGuard', but only one—AgentGuard by GoPlus Security—is a verifiable, installable runtime guard. A scanner called 'SkillGuard' was flagged as malicious and pulled fro…
AI and supply-chain governance are making bespoke software cheaper and safer than using third-party libraries, reversing the long-standing 'don't reinvent the wheel' advice. The cost of writing custom…
Age of Agents, a new open-source tool from Agents Mill, visualizes AI coding agent sessions as a real-time strategy game, turning each session into a settler in a pixel-art realm. The tool runs locall…
A security team used an AI agent to build a CVE scanner that queries NVD, GitHub Advisory DB, and CISA KEV, classifies vulnerabilities by type, and scores actionability. The agent was removed from the…
An open-source MCP server developer discovered that its README claimed 80 tools while the code actually registered 96, a discrepancy that went unnoticed for weeks. The undocumented tools included four…
A developer built and published an Apple Mail channel plugin for OpenClaw, an AI automation platform, enabling AI agents to monitor and respond to emails with per-thread session isolation. The plugin …
A developer released a TypeScript terminal user interface (TUI) and native desktop app for Pokémon Crystal that enables live play and LLM gameplay experiments. The tool, installable via npm, supports …
New research reveals that AI models do not invent fake names at random but often converge on the same plausible lies, creating a security and compliance risk. Studies found that code-generating LLMs h…
Microsoft's threat intelligence team attributed a supply chain attack targeting the Mastra AI ecosystem to North Korean state-sponsored hacking group Sapphire Sleet (BlueNoroff). The attackers comprom…