After hacking Trivy, TeamPCP moved to compromise repositories across NPM, Docker Hub, VS Code, and PyPI, stealing over 300GB of data.
Valentić told The Hacker News that the use of fake progress indicators mimicking legitimate installation progress and the ...
The newly observed malware abuses VS Code’s “runOn:folderOpen” feature to execute automatically from trusted projects, enabling near-frictionless compromise.
The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, ...
GlassWorm campaign injects malware into GitHub Python repos using stolen tokens since March 8, 2026, exposing developers to ...
A coordinated campaign targeting software developers with job-themed lures is using malicious repositories posing as legitimate Next.js projects and technical assessment materials, including ...
Attackers are targeting developers with malicious Next.js repositories to perform remote code execution (RCE) and establish a persistent command-and-control (C2) channel on infected machines in a ...
Microsoft Defender Experts identified a coordinated developer-targeting campaign delivered through malicious repositories disguised as legitimate Next.js projects and technical assessment materials.
Android security gets aggressive as Google bans thousands of developers and millions of sketchy apps
Google says it’s been increasingly relying on AI to counter AI-powered malware, strengthening Android defenses before threats reach users. Over 1.75 million harmful apps were blocked from the Play ...
Sandbox escape vulnerability in vm2, used by nearly 900 NPM packages, allows attackers to bypass security protections and execute arbitrary code. A critical vulnerability has been patched in vm2, a ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results