Ruflo v3.35.0 fixes a dependency bug where MetaHarness packages were silently absent due to being declared as optional peer dependencies, and implements ADR-381 to cap false promotions in its self-opt…
On Tuesday, threat actors compromised Jared Wray's GitHub account to publish a worm based on the open-sourced Mini Shai-Hulud malware, spreading to over 400 packages including Keyv and cacheable, with…
Security firm Zenity discovered a campaign that trojanized AI agent skills to deploy a credential stealer, amassing over 1.7 million downloads by Aug. 2. The malicious skills, uploaded to skills.sh on…
Truffle Security CEO Dylan Ayrey and Socket CEO Feross Aboukhadijeh said AI models are already capable of executing sophisticated cyberattacks, including SQL injection and supply chain attacks, and th…
A threat actor published more than 700 malicious packages to the npm registry over 48 hours, using AI-generated typo-squatted names to deliver a cross-platform RAT and infostealer. The packages, such …
Aikido Security disclosed a critical npm supply chain attack dubbed ChainDrop, which compromised popular packages including keyv, flat-cache, and file-entry-cache. The attackers hijacked maintainer Gi…
Cloudrift, a read-only AWS waste scanner, is now available as a command-line tool that estimates monthly costs of wasted resources without modifying or deleting anything. The tool, installable via npm…
CrowdStrike reported that 131 malicious packages were found on Microsoft's npm registry, targeting developers with credential-stealing malware. The discovery highlights supply chain risks in open-sour…
On March 31, 2026, Chaofan Shou discovered that Anthropic's Claude Code source code was exposed via a sourcemap file in the npm package, revealing the entire source code of the AI coding CLI. The leak…
Socket's Threat Research Team reported an active supply chain attack on August 4, 2026, that compromised the npm packages keyv and cacheable, affecting tens of millions of weekly downloads. The attack…
Snyk introduced Agentic AppSec with two new capabilities: Remediation Agent, now in public preview, and Malicious Code Defense, in private preview. The Remediation Agent automatically fixes vulnerabil…
The npm package keyv published version 6.0.0 on 4 August 2026 with a preinstall script that executes an obfuscated dropper, compromising any developer who installed it directly or as a transitive depe…
A developer released Yet Another OpenCode Plugin, an opencode plugin that adds terse response modes, a YAGNI-based 'lazy dev' ruleset, and two read-only agents (Review and Dream) to the opencode AI co…
Enterprises are facing three major AI security mistakes as AI agents move from pilots to production, according to an InfoWorld analysis. The mistakes include unvetted dependencies from npm, PyPI, and …
Enterprises are facing three major AI security mistakes as AI agents move from pilots to production, according to an InfoWorld analysis. The mistakes include unvetted dependencies from package registr…
A 16-year-old developer, Aarav, released Sprocket, an AI agent that creates hardware designs and writes code, and can autonomously purchase parts or SaaS subscriptions from any website. The tool, avai…
An engineer has built SlopScan, an open-source API that detects 'slopsquatting'—malicious packages pre-registered under names hallucinated by LLMs—and integrated it into Claude Code via a skill and a …
BroMetal, a new WebGPU graphics library from developer Eric Rowell, compiles TypeScript shaders into WGSL at build time, eliminating runtime shader compilation and reducing a typical app bundle to abo…
A developer released v3.0.0 of a CLI tool that converts Claude artifacts into native Windows applications, addressing reliability issues discovered after v2.0.0. The update fixes data persistence for …
NestJS developer MarvinRF released a major update to nestjs-docfy, adding mock servers, contract testing, and enhanced MCP server tools. The new CLI commands enable developers to spin up schema-based …