Microsoft’s GitHub has suffered what appears to be its biggest ever security breach after confirming that attackers ...

The Shai-Hulud supply-chain malware campaign is exploiting the automated systems developers trust to publish software safely.

Thirteen critical vulnerabilities have been found in the vm2 JavaScript sandbox package that could allow an attacker’s code ...

Socket is scaling to defend open source against supply chain attacks as AI accelerates software development. SAN ...

Socket raises $60M to expand AI-driven software supply chain security and protect developers from cyber threats worldwide.

Hadrian today released OpenHack, a tool for AI-powered source code review that delivers high-quality results at a fraction of the cost of a ...

TanStack has released a detailed postmortem describing a sophisticated supply-chain attack that compromised 42 npm packages ...

Then imagine it replying: "Sorry, the website won't let me in." That's the quiet failure mode behind most AI agents today.

Researchers say the campaign uses a browser-based JavaScript VM to hide credential theft and intercept MFA at scale.

When OpenAI engineers discovered that a poisoned update to a widely used JavaScript library had executed on two corporate ...

In March 2026, someone hijacked a maintainer account for Axios, a JavaScript HTTP library downloaded more than 45 million ...

Hundreds of npm packages infected by the self-propagating, credential-stealing worm from TeamPCP are related to the open ...