A developer created VulnGraph, a deterministic vulnerability oracle for AI coding agents that turns continuously changing vulnerability intelligence into verified, content-addressed snapshots. The too…
A developer discovered a data-loss bug in their open-source project safari-mcp on July 17, wrote a fix the same morning, and saw it pass CI on Node 20, 22, and 24 within minutes. Yet the fix sat unmer…
A developer upgraded GitHub Stats with additional data sources and metrics to track AI impact, finding that indicators such as .ai TLD registrations, npm package installs, arxiv uploads, and CloudFlar…
Gabriel Blessed released claw-coder, a fully autonomous local AI coding agent that runs entirely on the user's machine to prevent data leakage. The tool, installable via npm, features RAG capabilities…
Newsline, a new open-source tool by developer itdar, lets users display rotating one-line news headlines in their terminal status line, designed to be used while waiting for AI agents like Claude Code…
Seven malicious npm packages impersonating Vite's official @vitejs/* namespace were published between June 29 and July 3, delivering a remote access trojan via blockchain-based command-and-control inf…
In December 2025, Cline, an AI coding assistant with over 5 million users, suffered a four-hop supply chain compromise after a misconfigured GitHub issue triage workflow allowed any user to inject mal…
Cicy-code, a local-first multi-agent coding workspace distributed via npm, launches with a single binary (~30 MB) that sets up a development environment accessible at http://127.0.0.1:8008 within five…
A developer released cc-context-telemetry, an open-source tool that displays Claude Code's context window percentage, Pro/Max rate-limit usage with reset countdowns, and the current model in the statu…
A developer built a web-based AI agent using TypeScript, Vercel AI SDK, OpenRouter, and Next.js, converting a terminal-only agent into a full web app with streaming responses, a React chat interface, …
Ledger SAS launched Ledger Agent Stack, an open-source toolkit that lets developers build AI agents that can read balances and draft crypto transactions but cannot move funds without human approval on…
TypeScript developers face increased risk from malicious npm packages, with the Shai-Hulud 2.0 attack in November backdooring 796 packages totaling over 20 million weekly downloads and the Mini Shai-H…
A new open-source tool called mcp-trustcard scans Model Context Protocol (MCP) servers and assigns a public trust score out of 100, probing installability, protocol handshake, tool schema validity, de…
Aftr, an open-source Node controller for Adobe After Effects, lets users drive the software programmatically via JSON commands over WebSocket, enabling autonomous, spec-driven video pipelines that sel…
A developer created Claude Code skills to enforce safe dependency update practices for JavaScript and PHP projects, aiming to mitigate supply chain attacks. The skills require agents to research recen…
Compromised npm packages in the AsyncAPI namespace deliver the Miasma botnet loader, according to Socket AI Scanner. The malicious packages @asyncapi/generator-helpers, @asyncapi/generator-components,…
Aikido Intel, a real-time supply chain intelligence feed from Aikido, detected 19,500 malicious packages out of 7.5 million analyzed in Q2 2026, identifying most within 8 minutes of release. The feed …
A developer built thingd, an open-source, ultra-fast data engine designed for AI agents, arguing that the rise of autonomous agents requires a new 'agent-native' backend stack that strips away traditi…
Refuse, an open-source tool that intercepts package manager calls to block vulnerable installs before they execute, launched to address a structural gap in AI coding agent workflows. The tool installs…
A dependency firewall blocks malicious open-source packages at install time, a defense Aikido Intel says is necessary as it now analyzes up to 100,000 malicious packages daily, up from 20,000 a year a…