A developer warns that AI coding agents like Claude Code, Cursor, and Copilot generate tech debt by confidently guessing dependencies from frozen training data, unable to consider internal libraries, …
Figma announced code layers and AI plugin tools at Config 2026, enabling teams to clone repositories, convert components into editable code-backed layers, and build custom plugins via text prompts. Th…
Four projects share the name 'SkillsGuard', but only one—AgentGuard by GoPlus Security—is a verifiable, installable runtime guard. A scanner called 'SkillGuard' was flagged as malicious and pulled fro…
AI and supply-chain governance are making bespoke software cheaper and safer than using third-party libraries, reversing the long-standing 'don't reinvent the wheel' advice. The cost of writing custom…
Age of Agents, a new open-source tool from Agents Mill, visualizes AI coding agent sessions as a real-time strategy game, turning each session into a settler in a pixel-art realm. The tool runs locall…
A security team used an AI agent to build a CVE scanner that queries NVD, GitHub Advisory DB, and CISA KEV, classifies vulnerabilities by type, and scores actionability. The agent was removed from the…
An open-source MCP server developer discovered that its README claimed 80 tools while the code actually registered 96, a discrepancy that went unnoticed for weeks. The undocumented tools included four…
A developer built and published an Apple Mail channel plugin for OpenClaw, an AI automation platform, enabling AI agents to monitor and respond to emails with per-thread session isolation. The plugin …
A developer released a TypeScript terminal user interface (TUI) and native desktop app for Pokémon Crystal that enables live play and LLM gameplay experiments. The tool, installable via npm, supports …
New research reveals that AI models do not invent fake names at random but often converge on the same plausible lies, creating a security and compliance risk. Studies found that code-generating LLMs h…
Microsoft's threat intelligence team attributed a supply chain attack targeting the Mastra AI ecosystem to North Korean state-sponsored hacking group Sapphire Sleet (BlueNoroff). The attackers comprom…
OpenCode, an open-source coding agent, faces plugin management issues in enterprise deployments, including stale versions and private registry failures. A workaround involves using exact version pinni…
A developer released namecom-cli, a command-line tool for Name.com DNS and domain management built on the v4 API, designed for both human and AI agent use. The tool supports idempotent operations, sec…
North Korean threat actor Sapphire Sleet compromised the Mastra AI open-source framework on June 17, 2026, by hijacking a maintainer's npm credentials and poisoning 141 packages within 88 minutes. The…
A malicious npm package named @withgoogle/stitch-sdk impersonates Google's Stitch AI design tool by squatting the @withgoogle scope, harvesting developer credentials from eight sources via a preinstal…
A new open-source tool called Overreach detects when AI coding agents add unauthorized code—such as endpoints, dependencies, or cron jobs—beyond the original prompt. The tool compares a developer's pr…
A developer has released SvGrid, a native data grid for Svelte 5 that is MIT-licensed and available on npm as @svgrid/grid. The grid features fine-grained reactivity using Svelte 5 runes, supports vir…
Logslim, an open-source CLI and GitHub Action, reduces test and build log output by 80-95% for AI agents and human reviewers, compacting noisy CI logs into structured failure summaries with fix hints.…
A Hacker News user asks whether the community will develop tools that structure command-line output specifically for LLM consumption, noting that current compression methods save tokens but may increa…
Airgap, a new Linux tool, wraps programs in namespaces to hide secrets from AI agents and block npm malware that steals credentials at install time. It redacts sensitive files like .env and SSH keys f…