Aftr, an open-source Node controller for Adobe After Effects, lets users drive the software programmatically via JSON commands over WebSocket, enabling autonomous, spec-driven video pipelines that sel…
A developer created Claude Code skills to enforce safe dependency update practices for JavaScript and PHP projects, aiming to mitigate supply chain attacks. The skills require agents to research recen…
Compromised npm packages in the AsyncAPI namespace deliver the Miasma botnet loader, according to Socket AI Scanner. The malicious packages @asyncapi/generator-helpers, @asyncapi/generator-components,…
Aikido Intel, a real-time supply chain intelligence feed from Aikido, detected 19,500 malicious packages out of 7.5 million analyzed in Q2 2026, identifying most within 8 minutes of release. The feed …
A developer built thingd, an open-source, ultra-fast data engine designed for AI agents, arguing that the rise of autonomous agents requires a new 'agent-native' backend stack that strips away traditi…
Refuse, an open-source tool that intercepts package manager calls to block vulnerable installs before they execute, launched to address a structural gap in AI coding agent workflows. The tool installs…
A dependency firewall blocks malicious open-source packages at install time, a defense Aikido Intel says is necessary as it now analyzes up to 100,000 malicious packages daily, up from 20,000 a year a…
The jscrambler npm package was backdoored five times in three hours on July 11, 2026, after a threat actor stole an npm publishing credential. The malicious versions (8.14.0–8.20.0, excluding 8.15.0) …
On July 11, 2026, a supply chain attack compromised the popular jscrambler npm package, with malicious versions deploying a cross-platform infostealer written in Rust. The malware targeted developer c…
Priya Nair published a tutorial on building a TypeScript CLI that connects to any Model Context Protocol (MCP) server, enabling Claude to discover and call tools at runtime without hardcoded function …
The official jscrambler npm package published five compromised versions on July 11, 2026, using a preinstall hook to drop a Rust infostealer that targets AI developer tool configurations, cloud creden…
Gitlawb-zero is preparing a 0.4.0 release that ships a native npm binary as platform optionalDependencies, improving install speed and security. The update also tightens sandboxing by classifying sile…
A census of 15,382 Model Context Protocol servers found that 47% run remotely, 16% have verified problems such as deleted GitHub repos or deprecated packages, and 9,207 servers have fewer than 10 star…
A developer built CXGRD, a CLI tool that maps code dependencies and calculates blast radius to solve the stateless context problem in AI coding agents. The tool provides enriched prompts and compiler-…
A developer built all-llm-token-tracker, an npm package that tracks input and output tokens for LLM API calls in Node.js. The tool supports manual recording, auto-wrapping of OpenAI and Anthropic call…
Ingit, a Git GUI that runs in the browser, has been released as a vibecoded alternative to ungit. The tool features a commit graph, optimistic mutations, time machine, GitHub integration, and agent se…
An autonomous agent has built and maintains a leaderboard ranking 9,868 MCP servers by GitHub stars, npm downloads, and maintenance activity, updated every other day without human intervention. The ra…
Researchers reported in July 2026 that nine widely used AI coding tools, including Cursor, GitHub Copilot, Gemini CLI, and Windsurf, share a common failure mode called HalluSquatting. Attackers exploi…
A developer ran 70 MCP servers in a sandboxed environment using Docker and strace to log runtime behavior, finding that 67 were clean at startup, 3 made outbound HTTPS connections consistent with thei…
Wonsuk Choi released Crondex, a public directory of 35 pre-made cron jobs across 7 categories designed for AI agents to browse, tweak, and schedule. The tool is available on GitHub and npm, enabling a…