An attacker compromised the npm account of a lead Axios maintainer on March 30, and used it to publish two malicious versions ...

An extremely popular NPM package used in many JavaScript projects has been compromised and can wreak havoc on your machine if ...

North Korean hackers exploit VS Code tasks.json auto-run since Dec 2025 to deploy StoatWaffle malware, stealing data and ...

Interlock exploits CVE-2026-20131 zero-day since Jan 26, enabling root access on Cisco FMC, increasing ransomware risks.

OX Security reported a phishing campaign targeting developers using OpenClaw's name to lure victims into a fake site for ...

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, ...

Researchers say they’ve discovered a supply-chain attack flooding repositories with malicious packages that contain invisible ...

ThreatDown, the corporate business unit of Malwarebytes, today published research documenting what researchers believe to be ...

Has AI coding reached a tipping point? That seems to be the case for Spotify at least, which shared this week during its fourth-quarter earnings call that the best developers at the company “have not ...

Strip the types and hotwire the HTML—and triple check your package security while you are at it. JavaScript in 2026 is just getting started. I am loath to inform you that the first month of 2026 has ...

Engineers in Silicon Valley have been raving about Anthropic’s AI coding tool, Claude Code, for months. But recently, the buzz feels as if it’s reached a fever pitch. Earlier this week, I sat down ...