The campaign spans npm, Packagist, Go, and Chrome, using obfuscated JavaScript loaders and VS Code tasks to deliver malware.

AI Now’s Friendly Fire PoC shows Claude Code and Codex running README-planted payloads on hosts when autonomous command ...

Learn how EvilTokens hides Microsoft 365 phishing behind browser-side decryption and how browser-level analysis helps SOC ...

Modern JavaScript teams do not just need more vulnerability reports. They need dependency decisions that developers can ...

A large-scale phishing operation has been observed disguising a malicious script as a TrueType font file (.tff). Using the ...

Build type-safe JavaScript applications in less time with Microsoft’s native port of TypeScript built with Go.

Visual Studio Code 1.129 adds a dedicated process for running AI agent sessions and an experimental docked editor for reviewing agent-generated changes.

TypeScript 7.0 is now stable after Microsoft ported the entire compiler to Go, delivering build-time speedups of 8x to 12x ...

ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't ...

Bitdefender researchers show how Windows bind links can create conflicting filesystem views to hide malware from endpoint ...

Canva launched Canva Code 2.0, an AI coding tool that lets users build websites and interactive apps from text prompts, ...

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...