The Shai-Hulud supply-chain malware campaign is exploiting the automated systems developers trust to publish software safely.

The Microsoft-owed software developer platform, GitHub, has confirmed a third-party has gained unauthorized access to 3800 ...

GitHub is investigating a breach of its internal repositories after the TeamPCP hacker group claimed to have accessed ...

The world’s largest open-source registry, node package manager (npm), has been hit by another fast-moving malware attack, ...

Mini Shai-Hulud hit 2 OpenAI devices via TanStack, exposing limited credentials and forcing macOS certificate updates by June ...

Video face swap with VidMage Try It Now A few years ago, swapping a face in a video meant either academic Python scripts ...

Microsoft Threat Intelligence said attackers placed malicious code inside a Mistral AI download distributed through a Python ...

The website for the popular JDownloader download manager was compromised earlier this week to distribute malicious Windows ...

In March 2026, someone hijacked a maintainer account for Axios, a JavaScript HTTP library downloaded more than 45 million ...

Hugging Face hosts 352,000 unsafe model issues. ClawHub's registry contains 341 malicious AI agent skills. The AI supply chain is now the most attractive target in software security.

Companies are treating these repositories like content delivery networks - now the Linux Foundation and colleagues are saying enough is enough. Here's the plan.