A malicious package masquerading as a legitimate dependency compromised Axios, impacting millions. Learn how the attack unfolded and what developers can do to protect their projects.
Anthropic inadvertently exposed the full source code of its Claude Code client through an unminified JavaScript source map on npm. This oversight reveals internal project details, unreleased features, and future development plans, sparking debate within the developer community.
A sophisticated supply chain attack has compromised the widely-used Axios JavaScript library, deploying a remote access Trojan (RAT) to developer machines and CI/CD servers. Urgent action is advised for users running affected versions due to potential credential theft and data exfiltration.
A sophisticated supply chain attack targeting the widely used Axios JavaScript library has compromised developer systems, leading to potential theft of credentials and API keys. Developers are urged to check for compromise and implement immediate security measures.
A developer narrowly avoided a sophisticated supply chain attack involving hidden Unicode characters and a multi-stage `eval` payload within a trusted pull request. Learn how the `ignore-scripts` configuration became a crucial defense.
A widely used npm package was compromised, silently installing the powerful AI agent OpenClaw on developer systems. This incident highlights critical supply chain vulnerabilities and the dangers of AI agents with broad system access.
The software development landscape is rapidly evolving with the rise of AI Skills, designed to augment AI agent capabilities. Concurrently, a new high-performance npm registry browser, npmx, promises to drastically improve package exploration, setting a new standard for developer tools.
A recent supply chain attack has compromised hundreds of npm packages, exposing critical CI/CD vulnerabilities, while the utility of AI media generation faces renewed developer skepticism. Concurrently, a fierce competition for AI hardware leadership unfolds between tech giants, redefining the industry's future.
A sophisticated supply chain attack, dubbed Shai Hulud, has compromised over 500 npm packages, leveraging GitHub Actions vulnerabilities to exfiltrate secrets and propagate malicious code. This incident marks a critical shift from theoretical threats to confirmed real-world impact across major tech vendors.