The typosquatted “@acitons/artifact” package targeted GitHub’s CI/CD workflows, stealing tokens and publishing malicious ...

Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.

A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be ...

Cybersecurity researchers have flagged a malicious Visual Studio Code (VS Code) extension with basic ransomware capabilities ...

GlassWorm, a self-propagating VS Code malware first found in the Open VSX marketplace, continues to infect developer devices ...

The payload is triggered only between August 8, 2027, and November 29, 2028, and does two destructive things: randomly kills ...

Israeli security researchers identified a malicious spyware campaign in the NPM ecosystem that remained hidden from most ...

The bug exposes the Metro development server to remote attacks, allowing arbitrary OS command execution on developer systems ...

Developers will have to contend with a dormant turned active malicious code on Visual Studio Code (VS Code) extensions, which ...

Vulnerabilities in AI-assisted technology can snowball into national security risks; building safeguards and governance ...

The GlassWorm malware has reared its ugly head again in the Open VSX registry, roughly two weeks after being removed.

The security research team at JFrog, a provider of a platform for building and deploying software, have discovered a critical vulnerability in a node ...