Packagist packages hid malicious package.json scripts, enabling Linux binary execution during installs and workflows.

The Shai-Hulud supply-chain malware campaign is exploiting the automated systems developers trust to publish software safely.

Claude Code Dynamic Workflows, launched May 28, 2026, replaces context-window orchestration with a JavaScript script Claude writes on the fly for each task. Runs cap at 1,000 parallel subagents with ...

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and ...

The controversy over vibe coding reached a new high this week after a developer added hidden instructions to his open source ...

Google on Wednesday published exploit code for an unfixed vulnerability in its Chromium browser codebase that threatens ...

Visual Studio Code 1.121 focuses on agent workflows, model configuration, terminal behavior and built-in preview features -- and features another update to Claude Code functionality.

MYRTLE BEACH, SC (WMBF) - The Better Business Bureau is warning consumers about a “brushing” scam involving unsolicited packages that arrive at their homes. The scam works by companies finding names ...

Claude’s Computer Use feature can do something an ordinary chatbot cannot. It can open a terminal on your computer and install software on your behalf, including packages pulled straight from npm, the ...