The Shai-Hulud supply-chain malware campaign is exploiting the automated systems developers trust to publish software safely.

Bumblebee from Perplexity scans developer machines for compromised packages and AI tool configs, without triggering malware.

Attackers are increasingly abusing Microsoft’s legacy MSHTA utility to silently deliver malware, stealers, and persistent ...

Matteo Collina has proposed a Virtual File System (VFS) for Node.js core through the node:vfs module. The proposal includes about 19,000 lines of code and addresses common workflow challenges. While ...

Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system (LMS) to deploy the Godzilla web shell.

In March 2026, someone hijacked a maintainer account for Axios, a JavaScript HTTP library downloaded more than 45 million ...

The world’s largest open-source registry, node package manager (npm), has been hit by another fast-moving malware attack, ...

The security platform Socket has recently discovered an enormous worldwide malware operation that has been dubbed "TrapDoor".

Several SAP npm packages were exposed to a supply chain attack. The hacker group TeamPCP is behind it, say security researchers.

Ghostwriter used Prometheus lures since spring 2026 to target Ukraine agencies, enabling malware delivery and data theft.

The NCAA denied Texas Tech QB's Brendan Sorsby's reinstatement request amid his gambling addiction and violation. Here's what's next.

The AI governance gap is real - and it's coming at a high cost to enterprise organizations. The JFrog 2026 Software Supply ...