Companies are treating these repositories like content delivery networks - now the Linux Foundation and colleagues are saying ...

Open source software with more than 1 million monthly downloads was compromised after a threat actor exploited a ...

Malicious Lightning 2.6.2/2.6.3 released April 30 enable credential theft via hidden payload, leading to PyPI quarantine and ...

A North Korean APT has crafted malicious software packages to appeal to AI coding agents, while ‘slopsquatting’ shows the ...

The rise of AI services, rapid software updates and unseen third-party data flows is exposing the limits of annual vendor ...

Anaconda Inc., the trusted foundation for AI-native development, today announced the acquisition of Outerbounds, the company behind Metaflow, the open source AI/ML orchestration framework trusted by ...

Scammers built a convincing fake Windows update site that installs password-stealing malware. Learn how the multi-stage attack works and how to stay safe.

Several npm packages for SAP's cloud application development ecosystem have been compromised as TeamPCP's supply chain ...

ESET researchers have investigated an ongoing attack by the ScarCruft APT group that targets the Yanbian region via ...

Say "no" to running dubious scripts.

Claude Opus commit added malicious npm dependency in Feb 2026, enabling crypto theft and persistent RAT access.

My homelab actually pays off now.