Arch Linux AUR malware has forced an emergency adoption freeze after Wave Three of the Atomic Arch campaign deployed a ...

Aikido Security says an npm supply chain attack has infected Keyv packages with a variant of the credential-stealing ...

keyv npm supply chain attack on August 4, 2026 let the Shai-Hulud worm compromise 400-plus packages and more than two billion ...

A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.

A leaked n8n API key is only the start. GitGuardian's research traces the full chain, from exposed tokens and weak keys to ...

At Black Hat USA, Zenity Labs today announced new research detailing an active credential-stealing malicious skills campaign distributed through Vercel's skills.sh. The affected skill family amassed ...

The Shai Hulud variant’s blast radius includes several highly popular packages thus far.. Security teams are urged to perform ...

Thousands of Internet-connected servers sold by the world’s biggest manufacturers can be remotely backdoored by exploiting ...

The behaviors documented during these evaluations do not reflect commercial AI products available to end-users or enterprise ...

Malicious npm packages impersonate Alibaba tools to deliver a cross-platform RAT with command execution, persistence, and ...

A self-spreading worm poisoned hundreds of npm packages in hours, slipped past provenance checks, hid its controls on Ethereum, and hunted AI-tool keys.