Supply chain attacks on the npm ecosystem have become a primary method for compromising production systems, with attackers hiding malicious code inside trusted packages. The article provides concrete …
Perplexity released Bumblebee, an open-source security scanner for macOS and Linux that detects risky packages, browser extensions, editor extensions, and AI tool configurations in local developer env…
This article provides a security baseline configuration for the JavaScript package managers npm, pnpm, and bun, designed to mitigate supply-chain risks. It specifies minimum version requirements and r…
The article announces that yt-dlp is limiting and deprecating support for Bun as a JavaScript runtime due to compatibility and security issues. Only Bun versions 1.2.11 through 1.3.14 will be supporte…
The article provides configuration snippets for Unix shells (`.zshrc`, `.bashrc`) and PowerShell profiles to wrap package manager commands (`npm`, `pnpm`, `bun`, `yarn`) with the Socket Firewall (`sfw…
GitHub open-sourced Spec Kit, a toolkit that forces AI coding agents to create a structured specification before writing any code, requiring them to ask clarifying questions and plan architecture firs…
MacOS automation setup using two launchd plist files and two shell scripts to perform daily system updates and hourly cleanup tasks. The daily-update script updates Homebrew, npm, and various develope…
In October 2021, the popular npm package `ua-parser-js`—used by major companies like Facebook and Google with 7 million weekly downloads—had no reported vulnerabilities and clean code, but its maintai…
Supply chain attacks on npm and GitHub Actions are exploiting the gap between malicious package publication and CVE issuance, with attackers publishing compromised versions that are installed by thous…
According to a May 22, 2026 update, the MCP ecosystem has expanded significantly, evolving from a protocol into a standard method for granting AI models access to tools like databases and APIs. Howeve…
On May 18, 2026, Shopify released @shopify/ucp-cli, an open-source command-line tool and MCP server that functions as an AI shopping agent powered by the Universal Commerce Protocol (UCP). The CLI con…
Nine malicious npm packages impersonating Polymarket trading tools were published on May 20, 2026, by the account "polymarketdev," stealing cryptocurrency wallet private keys upon installation. The pa…
On May 11, 2024, TanStack suffered a sophisticated supply-chain attack that compromised 42 npm packages and published 84 malicious versions within six minutes. The attackers exploited GitHub Actions c…
Seed4j-mcp is a new open-source Model Context Protocol (MCP) server that allows AI agents like Claude Code and Cursor to control the seed4j application generator, enabling them to scaffold Spring Boot…
Three versions of the widely used npm package node-ipc (9.1.6, 9.2.3, and 12.0.1) were compromised on May 14, 2026, after an attacker took over the co-maintainer account "atiertant" and published mali…
Five typosquatting npm packages published by accounts named "superbase" and "micresoft" contain a hidden 4.5 MB ELF binary that executes automatically upon `npm install` and, through a hijacked `Sessi…
On May 11, 2026, an attacker compromised the TanStack Router/Start repository and published 84 malicious npm package versions across 42 packages by exploiting a pull_request_target vulnerability, GitH…
A malicious npm package named "exiouss" was published on May 1, 2026, by the account "loltestpad" as a rebranded version of the previously removed "godsplan" package, now bundling a PowerShell script …
The PyTorch Lightning deep-learning framework was compromised on PyPI, with versions 2.6.2 and 2.6.3 containing a credential-stealing worm called Shai-Hulud. The malware activates when Python code run…
Setting a minimum release age (cooldown) on dependencies is a low-effort, high-impact defense against supply-chain attacks, as most malicious packages are detected and removed within hours. All three …