On March 24, 2026, developers building AI applications with LiteLLM — a Python package with 95 million monthly downloads — unknowingly installed malicious code. A threat actor group known as TeamPCP ...

Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk ...

New Package Firewall CLI, VS Code extension, and AI coding assistant plugins enforce package trust before malicious or policy-violating dependencies are installed. The release introduces three new ...

Amazon linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers. The cloud computing giant linked the ...

The above button links to Coinbase. Yahoo Finance is not a broker-dealer or investment adviser and does not offer securities or cryptocurrencies for sale or facilitate trading. Coinbase pays us for ...

Browser-agent debugging is becoming a real developer-tooling surface, not just a prompt pattern. The Safari MCP server matters because it gives agents direct access to the runtime evidence behind ...

Six malicious npm packages mimicking Rollup polyfill tools stole developer credentials and enabled remote access in a Lazarus-linked campaign. The attack uses a layered delivery chain designed to ...

The Swift Package Index is no longer independent as Apple has taken control, but it will remain an open source search engine for third-party code. The Swift Package Index gave developers one trusted ...

One of the largest open-source package repositories just spent a weekend cleaning up after a malware campaign that did not break into anything. It did not need to. Attackers seized control of more ...

A malicious package targeting software developers has been discovered on npm, one of the most widely used package registries in the world. The package, named dbmux, was found to contain hidden malware ...

Apple is opening App Store subscription bundles to developers from different companies, giving independent app makers a new way to package services together and sell them at a combined price. The ...

With Monday's keynote behind them, Apple developers at WWDC 2026 shifted into the hands-on phase Tuesday as Craig Federighi, the company's senior vice president of software engineering, fielded ...