With over 2.2 billion installs, the flawed Python package offers attackers a huge blast radius, including silent access to ...

A new report out today from cybersecurity company Forcepoint LLC’s X-Labs research team details a supply chain attack that compromised LiteLLM, a widely used open-source Python ...

TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious versions anyway. The CI/CD Trust-Chain Audit Grid maps the six gaps it ...

Sometime around the last week of May 2026, attackers uploaded poisoned packages to three of the most widely used software ...

Socket found seven malicious packages on PyPI The packages were abusing Gmail and WebSocket They were removed from the platform Several malicious PyPI packages were recently observed abusing Gmail to ...

GitHub hack exposed 3,800 internal repos through a poisoned VS Code extension, raising new concerns over developer supply ...

A GitHub employee installed a routine VS Code extension update, handed cybercrime group TeamPCP enough access to exfiltrate approximately 3,800 of GitHub's internal source code repositories — everythi ...

The smartest way to use AI may not be letting it touch your files, but asking it to write software that handles them safely - ...

Milestone Mojo release reveals a systems programming language with precise control over memory, strong types, GPU programming support, and intuitive Python-like syntax.

The OWASP-backed tool scans JavaScript and TypeScript lockfiles locally, aiming to help developers catch and remediate dependency risks before CI failures.

China’s performance as the leading country for chemistry research in the Nature Index is remarkable. Since 2015, it has increased its output in the subject by almost 350%, reaching a Share of more ...

Anthropic acquired Stainless, the SDK compiler behind OpenAI, Gemini and Llama. The deal hands one AI lab structural leverage over rivals' developer ecosystems.