keyv npm supply chain attack on August 4, 2026 let the Shai-Hulud worm compromise 400-plus packages and more than two billion ...

Open VSX removes 77 evil twin extensions that impersonate developer tools and exfiltrate host, workspace, Git, and CI data.

Aikido Security says an npm supply chain attack has infected Keyv packages with a variant of the credential-stealing ...

MCP is Anthropic’s open standard for connecting AI agents to your tools and data. Here is what it actually is, how it differs from a REST API, and a clear rule for when to use each in 2026.

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals ...

Malicious npm packages impersonate Alibaba tools to deliver a cross-platform RAT with command execution, persistence, and ...

Dependency confusion is a supply chain issue that affects how package managers choose where to download a dependency from. If your build or developer tooling can see both a private package registry ...

The Shai Hulud variant’s blast radius includes several highly popular packages thus far.. Security teams are urged to perform ...

In what they call the first-ever real-world agent-to-agent exploitation method, Pillar Security researchers say they ...

TripGain MCP Server launches at GBTA Convention 2026, extending agentic AI beyond flight booking to handle employee expense ...

Stop uploading to Google Drive for file sharing—this app keeps everything on your Wi-Fi.