The npm package @copilot-mcp/apex is a postinstall dropper that installs a macOS infostealer on any machine that runs npm install or npx @copilot-mcp/apex, according to a security analysis. The packag…
Szr, a Go-native CLI proxy developed by devr-tools, reduces noisy terminal output before it reaches an LLM context, preserving exit codes and saving tokens on logs, diffs, and test output. It wraps co…
Developer Raj Nandan released json-to-md, an open-source tool that converts JSON documents into deterministic, human-readable GitHub Flavored Markdown, with byte-identical output across TypeScript and…
Pkgxray, a pre-install security tool for npm packages, MCP servers, and AI agents, uses static analysis to inspect packages before installation, reporting SAFE, REVIEW, or BLOCK verdicts without execu…
Claude Code hides context window usage and API rate-limit data until users hit limits, but a developer created the open-source npm package cc-context-telemetry to expose these numbers. The tool wraps …
A sophisticated multi-stage npm supply chain worm called SANDWORM_MODE was discovered in early 2026, targeting AI-augmented development environments like GitHub Copilot and Cursor. The worm exploits i…
A new independent study by researcher Aleksandr Churilov found that five frontier large language models—Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2—collectivel…
Developer Matheus Gomes released Decoreba, a 6.2 MB command palette for the terminal written in pure Go with zero dependencies, featuring fuzzy search, typo tolerance, recency ranking, and an MCP serv…
A developer created VulnGraph, a deterministic vulnerability oracle for AI coding agents that turns continuously changing vulnerability intelligence into verified, content-addressed snapshots. The too…
A developer discovered a data-loss bug in their open-source project safari-mcp on July 17, wrote a fix the same morning, and saw it pass CI on Node 20, 22, and 24 within minutes. Yet the fix sat unmer…
A developer upgraded GitHub Stats with additional data sources and metrics to track AI impact, finding that indicators such as .ai TLD registrations, npm package installs, arxiv uploads, and CloudFlar…
Gabriel Blessed released claw-coder, a fully autonomous local AI coding agent that runs entirely on the user's machine to prevent data leakage. The tool, installable via npm, features RAG capabilities…
Newsline, a new open-source tool by developer itdar, lets users display rotating one-line news headlines in their terminal status line, designed to be used while waiting for AI agents like Claude Code…
Seven malicious npm packages impersonating Vite's official @vitejs/* namespace were published between June 29 and July 3, delivering a remote access trojan via blockchain-based command-and-control inf…
In December 2025, Cline, an AI coding assistant with over 5 million users, suffered a four-hop supply chain compromise after a misconfigured GitHub issue triage workflow allowed any user to inject mal…
Cicy-code, a local-first multi-agent coding workspace distributed via npm, launches with a single binary (~30 MB) that sets up a development environment accessible at http://127.0.0.1:8008 within five…
A developer released cc-context-telemetry, an open-source tool that displays Claude Code's context window percentage, Pro/Max rate-limit usage with reset countdowns, and the current model in the statu…
Ledger SAS launched Ledger Agent Stack, an open-source toolkit that lets developers build AI agents that can read balances and draft crypto transactions but cannot move funds without human approval on…
TypeScript developers face increased risk from malicious npm packages, with the Shai-Hulud 2.0 attack in November backdooring 796 packages totaling over 20 million weekly downloads and the Mini Shai-H…
A new open-source tool called mcp-trustcard scans Model Context Protocol (MCP) servers and assigns a public trust score out of 100, probing installability, protocol handshake, tool schema validity, de…