Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...

Meta recently open-sourced Brain2Qwerty v2, a noninvasive Brain–Computer Interface (BCI) that can decode sentences from ...

In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to ...

According to Socket, malicious payment SDK packages on npm and PyPI are harvesting developer credentials and CI/CD ...

Excel is everywhere—more than 750 million people open a workbook each year to balance budgets, fine-tune supply chains, and ...

Zscaler found attackers using SEO poisoning and hidden prompts in malicious websites to manipulate AI agents into making cryptocurrency payments.

Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS ...

A so-called software supply chain attack, in which hackers corrupt a legitimate piece of software to hide their own malicious code, was once a relatively rare event but one that haunted the ...

Any development environment that installed or imported one of the 172 compromised npm or PyPI packages published since May 11 should be treated as potentially compromised. On affected developer ...

Security researcher Chaofan Shou discovered on March 31 that Anthropic's Claude Code CLI tool had its full TypeScript source code sitting in plain sight on the public ...