On June 17, 2026, an attacker compromised the @mastra npm organization and added the typosquat package easy-day-js as a dependency across 140+ Mastra AI framework packages, exposing over 1.1 million w…
A supply chain attack compromised over 140 npm packages in the @mastra scope, including @mastra/core with 918K weekly downloads, by injecting a malicious dependency that executes a postinstall script …
The StepSecurity Threat Intelligence Team has identified that multiple @mastra npm packages have been compromised. The security breach was disclosed in a GitHub issue on the mastra-ai/mastra repositor…
Socket Threat Research identified shai_hulululud@1.0.48596, an npm package designed to probe AI-based malware scanners using prompt injection, token flooding, and obfuscated JavaScript. The package co…
Developer released Pacwich, a lightweight monorepo tool that works with Bun, npm, or pnpm, replacing the earlier bun-workspaces package. The tool requires zero configuration and uses plain package.jso…
Muster 1.0.0, a new CLI tool from developer Garrison, tests AI agent stacks across seven layers including persona, skills, SOP, tools, memory, heartbeat, and A2A. It performs both static validation an…
JerrySniffs launched an MCP server and API suite for web and social media search, offering credit-based access to Google, Twitter/X, Reddit, and page-to-markdown endpoints with no recurring subscripti…
Microsoft's platform teams discovered that AI coding agents ignore new CLI tools and default to older, more documented predecessors due to training data gravity, even when explicitly instructed otherw…
A developer built RagScope, an open-source tool that audits RAG pipelines to reveal wasted retrieval latency from chunks fetched but never used in the final prompt. The tool uses OpenTelemetry traces …
GitHits launched its public beta 0.9, a CLI and local MCP server that gives coding agents access to open-source code behind project dependencies. The tool indexes open-source code and documentation, a…
A developer released Pi, a coding agent that runs entirely on a local machine without API keys or cloud dependencies. Pi works with a local llama.cpp server hosting Google Gemma 4 models, enabling off…
A developer received a LinkedIn message from a recruiter at a crypto startup asking to review a GitHub repository before a technical interview. The repository contained a backdoor in npm's prepare scr…
A developer released cPanel MCP, a tool enabling AI agents to administer cPanel servers via WHM and UAPI, on npmjs.com. The tool dynamically probes server versions to avoid documentation drift and has…
A high school student in Italy built TITAN (Token Intelligence Through Agent Narrowing), a zero-dependency CLI framework that compresses AI coding agent token consumption by 70% to 85% without degradi…
A security researcher received a LinkedIn message from a recruiter at a crypto startup asking them to review a GitHub repo. The repo contained a backdoor that would execute arbitrary code when depende…
A developer analyzed Google Search Console data for their indie tool Mimi Seed and found that optimizing for generative engine optimization (GEO) is effectively just traditional SEO. The real issue wa…
WastedCode released TrueCast, a CLI and plugin system that installs portable expert personas—such as product manager, architect, and security reviewer—into Claude Code sessions. The tool provides vers…
Researchers presented a method for cross-language detection of malicious packages in npm and PyPI ecosystems at a 2023 conference. The approach aims to identify security threats across JavaScript and …
A developer explains why AI agents often ignore explicit rules, using a React Native project example where a rule against using 'pnpm add' for native packages was broken, causing a build failure. The …
Around 1,500 packages in the Arch User Repository (AUR) were compromised with rootkit-like malware. The attacker exploited a policy that allows takeover of orphaned packages after a two-week waiting p…