SAP npm packages poisoned on April 29, 2026 + AES-256-GCM encrypted credential theft + AI coding tools abused for spread.

OpenAI is mandating macOS users update ChatGPT Desktop and other apps by May 8, 2026, due to a compromised JavaScript library ...

Proof-of-concept exploit code has been published for a critical remote code execution flaw in protobuf.js, a widely used ...

If MediaFire shows a download error when you try to download a file in your browser, it usually means the file page loads correctly, but the actual ...

Claude Opus commit added malicious npm dependency in Feb 2026, enabling crypto theft and persistent RAT access.

John Warnick, owner of Celeritas, a consulting firm that works with internet service providers (ISPs) like Quantum Fiber from ...

The NHS Couch to 5k app is celebrating its 10-year anniversary having reached more than eight million downloads.

Fake packages aim to steal data, credentials, and secrets, and to infect every package created using them, in what could be ...

The Bitwarden CLI NPM package compromise is tied to a Checkmarx supply chain attack and references the Shai-Hulud worm.

As supply-chain attacks against widely-used, open-source software repositories continue, experts are urging developers to not ...

GlassWorm, a known malware, has put 73 harmful extensions into OpenVSX's registry. Hackers use it to steal developers' crypto ...

UNC6692 relies on email bombing and social engineering to infect victims with Snow malware: Snowbelt, Snowglaze, and ...