A Dune-inspired worm recently hit CrowdStrike and npm, infecting hundreds of packages. Here's what happened - and how to protect your code.

Newly discovered npm package 'fezbox' employs QR codes to hide a second-stage payload to steal cookies from a user's web browser. The package, masquerading as a utility library, leverages this ...

Process improvements and a closer look at funding streams will provide far more protection for the open source software we ...

Dozens of npm libraries, including a color library with over 2 million downloads a week, have been replaced with novel ...

GitHub enforces FIDO 2FA and seven-day token limits after Shai-Hulud npm attack to boost supply chain security.

Oracle has released JDK (Java Development Kit) 25, the first long term support (LTS) version since JDK 21 two years ago. New ...

ShadowV2 botnet exploits AWS Docker flaws using Python C2 and Go RAT, enabling sophisticated DDoS-for-hire attacks.

GitHub MCP Registry makes Model Context Protocol servers with GitHub repos discoverable from Visual Studio Code.

Bill is expected to make it a crime to intimidate or obstruct someone at a place of worship, school, or community centre, ...

Pair programming with ChatGPT Codex for a week exposed hard-won lessons every developer should know before trying it.

Plus: An investigation reveals how US tech companies reportedly helped build China’s sweeping surveillance state, and two ...

The Shai-Hulud NPM worm highlights rising open-source supply chain threats. Secure builds with SBOMs, MFA, signed packages, and zero-trust defenses.