A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and ...

The OWASP-backed tool scans JavaScript and TypeScript lockfiles locally, aiming to help developers catch and remediate ...

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious ...

Now sites have a new way to spy on their visitors: measuring subtle interactions with their solid-state drives. The technique ...

GlassWorm poisoned 300 GitHub repositories since 2025, enabling supply chain attacks against developers and organizations.

Solar and wind produce lots of energy — but not always at the right time. More battery storage could help Europe to stabilize prices and replace polluting fossil fuel energy, but roadblocks remain.

Developer platform Socket says a malware called TrapDoor is targeting crypto and AI developers across npm, PyPI and Crates, aiming to steal crypto wallet info and browser data.

GitHub’s internal repositories — now staged publishing in npm 11.15.0 requires a human 2FA approval before any package goes ...

Lupron Depot is a brand-name intramuscular injection (an injection given into the muscle). It’s prescribed for advanced prostate cancer and other hormone-related conditions, such as endometriosis, ...