Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions, ultimately delivering a 77…
On August 26, 2025, malicious versions of the Nx build package, which draws roughly four million downloads a week, were published to npm with a post-install hook that executed a credential-stealing sc…
A developer built Scout, an open-source tool that synthesizes OpenAPI specifications and documentation into a grounded understanding of APIs for coding agents. Scout runs locally and exposes context v…
A packaging error in Anthropic's Claude Code CLI tool version 2.1.88 leaked 513,000 lines of TypeScript source code across 1,906 internal files via npm on March 31, triggering malware campaigns on fak…
Google's Agent Development Kit (ADK) for TypeScript is now available as a flexible, model-agnostic framework for building and deploying AI agents. A sample 'Hello World' agent demonstrates local tools…
Anyclaude-SDK, a new open-source SDK that brings Claude Code-style agent capabilities to any OpenAI- or Anthropic-compatible LLM endpoint, has been released on npm. The SDK supports multi-agent teams,…
A developer open-sourced mcp-server-template, a production-ready TypeScript/Node.js foundation for building Model Context Protocol servers that connect AI agents like Claude Desktop and Cursor to tool…
Axtary, an open-source content authorization tool for AI agents, launched v0.5.0 on npm under Apache-2.0. The tool enforces policy on exact payloads—such as diffs, messages, or tool calls—before execu…
Skill registries extend beyond filesystem-based discovery to support publish, install, search, semantic search, dependency resolution, and trust signals, according to a lesson in the Agent Skills Mast…
A backend engineer built and published a Model Context Protocol (MCP) server for Spain's AEMET weather API, exposing three read-only tools. The API uses a two-step pattern where the first call returns…
Five major large language models (LLMs) — Claude, Codex, Gemini, and two others — consistently hallucinate the same 127 nonexistent Python and npm package names, according to researcher Aleksandr Chur…
Anthropic launched Claude Code in early 2025, a terminal-based agentic coding tool that uses the Claude 3.5 Sonnet model to read files, execute shell commands, and write code directly to a local files…
Palo Alto Networks acquired Koi, an AI-native developer security product, to address blind spots in EDR/XDR systems that cannot detect threats from VS Code extensions, local MCP servers, and rogue AI …
Researcher Aleksandr Churilov found that five top AI coding tools—Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2—hallucinate the same 127 nonexistent package name…
A free, open-source tool called Draw Your Font lets users turn a photo of their handwritten alphabet into an installable TTF, WOFF, or WOFF2 font entirely on their local machine, with no uploads or cr…
Developer danilo-znamerovszkij has open-sourced a pipeline that converts handwriting photos into TTF fonts using npm, with a Claude Code skill wrapper that automates vision labeling and local build. T…
A developer found that ten git worktrees consumed 9.9 GB of disk on an EXT4 filesystem, mostly from duplicate node_modules and vendor directories. Using jdupes to hardlink byte-identical files reduced…
Kimi K3, an AI system, exploited a Redis server using a 0-day vulnerability it discovered, completing the attack in 27 minutes with 32 agents, marking the first known instance of an LLM autonomously w…
GitHub new repositories surged 79.2% month-over-month to 9.0 million, while AI crawlers now account for 5.8% of all HTTP requests, according to Cloudflare Radar. The data, compiled from 15 sources inc…
The npm package @copilot-mcp/apex is a postinstall dropper that installs a macOS infostealer on any machine that runs npm install or npx @copilot-mcp/apex, according to a security analysis. The packag…