The jscrambler npm package was backdoored five times in three hours on July 11, 2026, after a threat actor stole an npm publishing credential. The malicious versions (8.14.0–8.20.0, excluding 8.15.0) …
On July 11, 2026, a supply chain attack compromised the popular jscrambler npm package, with malicious versions deploying a cross-platform infostealer written in Rust. The malware targeted developer c…
Priya Nair published a tutorial on building a TypeScript CLI that connects to any Model Context Protocol (MCP) server, enabling Claude to discover and call tools at runtime without hardcoded function …
The official jscrambler npm package published five compromised versions on July 11, 2026, using a preinstall hook to drop a Rust infostealer that targets AI developer tool configurations, cloud creden…
Gitlawb-zero is preparing a 0.4.0 release that ships a native npm binary as platform optionalDependencies, improving install speed and security. The update also tightens sandboxing by classifying sile…
A census of 15,382 Model Context Protocol servers found that 47% run remotely, 16% have verified problems such as deleted GitHub repos or deprecated packages, and 9,207 servers have fewer than 10 star…
A developer built CXGRD, a CLI tool that maps code dependencies and calculates blast radius to solve the stateless context problem in AI coding agents. The tool provides enriched prompts and compiler-…
A developer built all-llm-token-tracker, an npm package that tracks input and output tokens for LLM API calls in Node.js. The tool supports manual recording, auto-wrapping of OpenAI and Anthropic call…
Ingit, a Git GUI that runs in the browser, has been released as a vibecoded alternative to ungit. The tool features a commit graph, optimistic mutations, time machine, GitHub integration, and agent se…
An autonomous agent has built and maintains a leaderboard ranking 9,868 MCP servers by GitHub stars, npm downloads, and maintenance activity, updated every other day without human intervention. The ra…
Researchers reported in July 2026 that nine widely used AI coding tools, including Cursor, GitHub Copilot, Gemini CLI, and Windsurf, share a common failure mode called HalluSquatting. Attackers exploi…
A developer ran 70 MCP servers in a sandboxed environment using Docker and strace to log runtime behavior, finding that 67 were clean at startup, 3 made outbound HTTPS connections consistent with thei…
Wonsuk Choi released Crondex, a public directory of 35 pre-made cron jobs across 7 categories designed for AI agents to browse, tweak, and schedule. The tool is available on GitHub and npm, enabling a…
LoomBoard v0.1.2, a desktop chat app for the loomcycle agentic runtime, has been released with four packaging options including a Tauri v2 native desktop app, an npm CLI runner, an embeddable React co…
A new npm package, agent-security-scanner-mcp, has been published to help audit AI agents for security vulnerabilities. The tool scans agent configurations and dependencies to identify potential risks…
A developer has published a guide for building an Agentic OS, a lightweight automation layer that enables AI to autonomously inspect repositories, assign tasks, verify outputs, and enforce budgets. Th…
A developer built MarketNow, a marketplace that security-audits every MCP server before listing, after 30 CVEs were filed against MCP servers in 60 days. The audit pipeline, Sentinel, includes static …
Gawk CLI, a live AI-ecosystem feed for the terminal, launched on Hacker News. The tool provides curated news, model rankings, tool health, and SDK adoption data from public sources, with zero dependen…
Cfswitch, a new CLI tool, enables seamless switching between multiple Cloudflare accounts in Wrangler by using named auth profiles injected as environment variables. Built for AI agents and CI pipelin…
Socket's AI scanner detected 17 malicious npm and PyPI packages published on July 7, 2026, that typosquat popular payment apps PaySafe, Skrill, and Neteller to steal credentials and tokens from SDK de…