The Shai-Hulud supply-chain malware campaign is exploiting the automated systems developers trust to publish software safely.

TanStack has released a detailed postmortem describing a sophisticated supply-chain attack that compromised 42 npm packages ...

TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious ...

Security teams are grappling with a major supply chain attack on Axios, a popular JavaScript library with over 100 million weekly downloads. The North Korean state actor Sapphire Sleet compromised the ...

Strip the types and hotwire the HTML—and triple check your package security while you are at it. JavaScript in 2026 is just getting started. I am loath to inform you that the first month of 2026 has ...

Half a dozen vulnerabilities in the JavaScript ecosystem’s leading package managers — including NPM, PNPM, VLT, and Bun — could be exploited to bypass supply chain attack protections, according to ...

As global energy demand surges—driven by AI-hungry data centers, advanced manufacturing, and electrified transportation—researchers at the National Renewable Energy Laboratory have unveiled a ...

Google is removing support for the POP3 protocol, which allows users to sync emails from third-party accounts into Gmail. POP3 is an older standard of syncing emails, so it's not surprising that ...

Update: It’s now official, as Toyota has confirmed that it will begin importing three American-made models into Japan starting in 2026, including the Camry sedan, Highlander SUV, and Tundra pickup ...

An ongoing npm credential harvesting campaign operating since August 2025 has been discovered by researchers at Koi Security. The malware, dubbed PhantomRaven by the researchers, is actively stealing ...