Omegacode, an agent-agnostic workflow runner, launches as an open-source tool that orchestrates multiple coding agents including Claude Code, Codex, OpenCode, and pi using a deterministic DSL. The too…
A developer built ctxstash, a zero-dependency command-line tool that packs a codebase into a single Markdown file with a token count estimate, making it easier to share code with LLMs like ChatGPT and…
Socket's Threat Research team identified 23 new malicious PyPI packages in the Mini Shai-Hulud, Miasma, and Hades supply chain attacks, expanding the campaign to 471 artifacts across npm and PyPI. The…
An AI agent scaffolded a project using an outdated 2020 version because npx resolved to an old package version without engine constraints, due to npm's version resolution prioritizing engine compatibi…
The FiatDock team migrated its entire stack—Express server, fetch client, and MCP server—from x402 v1 to protocol v2 in a single evening, eliminating all 24 transitive npm vulnerabilities in the proce…
AI agents using npx without specifying a version can inadvertently scaffold projects from outdated templates due to npm's engine compatibility resolution, which prioritizes older versions without engi…
PostHog co-founder James Hawkins warns that the fragmentation of coding interfaces—from Slack bots to AI agents and MCP servers—is expanding the attack surface on developer devices faster than securit…
In May 2026, two supply-chain attacks targeted AI coding tools including Claude Code and Cursor, with one malicious VS Code extension stealing npm, AWS, GitHub, and SSH credentials from 6,000 develope…
A new variant of the Miasma worm has been discovered exploiting npm's binding.gyp build file to execute malicious code during package installation, bypassing traditional package.json script audits. Th…
The Miasma software supply chain attack toolkit has been released as open source across multiple GitHub repositories, likely through compromised developer accounts. The toolkit enables attackers to ex…
Socket Threat Research identified 23 new malicious PyPI packages in the Mini Shai-Hulud, Miasma, and Hades supply chain attacks, targeting bioinformatics and AI/MCP developers with trojanized native e…
Socket detected a coordinated PyPI compromise involving 37 malicious wheel artifacts across 19 packages, part of the Shai-Hulud/Miasma campaign that uses Python startup execution to download Bun and r…
Developer Jack Franklin launched ai-review, an open-source tool that lets terminal-based AI coding agents present plans and diffs in a browser for line-by-line review. The tool bridges the gap between…
A developer built Delay Mirror, a supply chain security gateway for package managers that blocks downloads of packages published within the last three days, after malicious code was pushed into npm pa…
A developer has created an auto-update script for Firecrawl that updates the CLI, skills from three separate repositories (cli, build, and workflows), and LLM context files sourced from Crawl4AI docum…
A single unsigned commit to the `icflorescu/mantine-datatable` repository added six files, five of which serve as launchers that execute a 4.3 MB dropper at `.github/setup.js`. The dropper, obfuscated…
Moonshot AI has released Kimi Code CLI, an open-source, MIT-licensed terminal-based AI coding agent written in TypeScript that can read and edit code, run shell commands, and fetch web pages. The tool…
A developer has published Throughline, a hook plugin for Claude Code that offloads tool I/O to SQLite to reduce token consumption. In a 50-turn session, the plugin reduced context from 125,000 tokens …
On June 3, 2026, attackers pushed malicious commits to the GitHub repository `icflorescu/mantine-datatable` and four sibling repos, planting a 4.3 MB payload from the Miasma worm family. The commit ad…
Llm-cli-gateway 2.0.0, released June 4, 2026, eliminates a major supply-chain vulnerability by replacing the `better-sqlite3` native module with Node's built-in `node:sqlite` driver. The change remove…