OpenCode, an open-source coding agent, faces plugin management issues in enterprise deployments, including stale versions and private registry failures. A workaround involves using exact version pinni…
A developer released namecom-cli, a command-line tool for Name.com DNS and domain management built on the v4 API, designed for both human and AI agent use. The tool supports idempotent operations, sec…
North Korean threat actor Sapphire Sleet compromised the Mastra AI open-source framework on June 17, 2026, by hijacking a maintainer's npm credentials and poisoning 141 packages within 88 minutes. The…
A malicious npm package named @withgoogle/stitch-sdk impersonates Google's Stitch AI design tool by squatting the @withgoogle scope, harvesting developer credentials from eight sources via a preinstal…
A new open-source tool called Overreach detects when AI coding agents add unauthorized code—such as endpoints, dependencies, or cron jobs—beyond the original prompt. The tool compares a developer's pr…
A developer has released SvGrid, a native data grid for Svelte 5 that is MIT-licensed and available on npm as @svgrid/grid. The grid features fine-grained reactivity using Svelte 5 runes, supports vir…
Logslim, an open-source CLI and GitHub Action, reduces test and build log output by 80-95% for AI agents and human reviewers, compacting noisy CI logs into structured failure summaries with fix hints.…
A Hacker News user asks whether the community will develop tools that structure command-line output specifically for LLM consumption, noting that current compression methods save tokens but may increa…
Airgap, a new Linux tool, wraps programs in namespaces to hide secrets from AI agents and block npm malware that steals credentials at install time. It redacts sensitive files like .env and SSH keys f…
Generative AI coding assistants are making programming language popularity less relevant, as tools like Claude Code can work with older languages like Perl if sufficient documentation exists. The auth…
A developer created a Toy Story-themed analogy for the open-source ecosystem, personifying tools like Python's cpython and Facebook's React as characters. The story explores conflicts between legacy a…
A new analysis warns that CLI token compression tools like RTK, despite promising up to 90% cost savings, introduce dangerous silent failures by stripping critical terminal output, leading to agent ha…
The npm account 'ai' publishes seven packages that collectively receive 964 million weekly downloads, yet none have npm provenance attestations. This single-publisher, no-provenance pattern mirrors re…
A new open-source CLI tool, mcp-customs, scans MCP servers for security risks before installation, running fully offline with no telemetry. It checks for issues like shell injection, path traversal, a…
A developer built NPM Safety Guard, a free IDE extension that scans package.json and lockfiles for malicious npm packages across 22 detection layers. The tool catches typosquats, AI-hallucinated packa…
Microsoft's VS Code 1.123, released June 3, introduces a two-hour delay before newly published extension versions auto-update, aiming to mitigate supply chain attacks by providing a window to catch ma…
Attackers are increasingly targeting developer endpoints to steal credentials, as demonstrated by supply chain attacks like Megalodon, TrapDoor, and Miasma. GitGuardian's new Developer Endpoint Protec…
A developer built a Docker MCP server with 50 tools after finding 11 existing packages fragmented across different licenses and feature sets. The server, which has achieved over 3,042 weekly downloads…
In June 2026, attackers hijacked the npm contributor account 'ehindero' to mass-publish malicious versions of 144 packages under the @mastra namespace, in what security researchers from JFrog, SafeDep…
An attacker hijacked a dormant contributor account and published malicious versions of 144 packages under the @mastra npm scope between 01:15 and 02:36 UTC, targeting the TypeScript AI agent framework…