A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...
Compromising the open-source supply chain is easy to do and spreads more quickly than traditional supply-chain attacks, ...
Upwind identified a malicious release of keyv@6.0.0 that harvested AWS, GitHub, and npm credentials via a hidden preinstall script. With 154 million weekly downloads, the compromise had ecosystem-wide ...
New York, USA, August 4th, 2026, FinanceWireOpen-source software has long been built on trust. Developers routinely install ...
A new version of the XCSSET malware is targeting thousands of macOS users through compromised Xcode projects and GitHub ...
New findings connect the same Pyongyang-backed group to four compromises dating to 2025, revealing a larger operation than ...
Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly ...
Typst is an easy and powerful markup-based language for creating technical documentation and books – and a compelling ...
Russian hackers exploit CVE-2026-42897 in OWA to deploy OWAReaper, a browser implant that persists through credential ...
An unknown Chinese threat actor runs leaked DarkSword across 100-plus web properties, using fake AWS and Apple logins to ...
Union.ai today announced the general availability of Flyte 2, a ground-up rebuild of its open-source platform for AI and ML engineers. Flyte ...
Open source software helps developers build applications faster, but every dependency can introduce security risks. In this ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results