On October 29, 2026, trojanized builds (2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace for macOS and Windows.

Binance’s November 3 findings trace the attack from a malicious interview assignment through developer tools, an internal AI tool, and stolen deployment credentials to wallet signing. We examine the ...

Harden-Runner’s behavioral monitoring has surfaced multiple supply chain attacks. The tj-actions/changed-files compromise is one example: the compromised action contacted gist.githubusercontent.com to ...

Inventory the Claude Code and Codex plugins on developer machines and in your GitHub repositories: where each came from, what it bundles, whether it is enabled, and which repositories distribute it.

Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual ...

litellm 1.107.0 shipped a credential stealer and an hourly remote code loader in all seven PyPI wheels and the official Docker images. The attacker hijacked BerriAI's release workflow with a GitHub ...

An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an ...

OpenCode reported a breach affecting Console users with linked AI providers. Here is what the vendor has said, and how to find OpenCode on your developer machines.

GhostAction returns: compromised maintainers push a fake security-audit.yml workflow that steals CI/CD secrets and cloud credentials from GitHub repos.

npm compromised package and cooldown checks Two StepSecurity GitHub Checks stop this kind of attack at the pull request, before anything is installed. The Package Compromised Updates check fails a PR ...

AI agent skills live in two places. Developers install them on their own machines, and teams commit them to repositories so everyone who works in the codebase gets them. A skill often travels between ...