A significant supply chain attack hit NPM after 15 popular Gluestack packages with over 950,000 weekly downloads were ...

Fake Alibaba Labs AI SDKs hosted on PyPI included PyTorch models with infostealer code inside. With support for detecting ...

Supply chain attack infects 16 GlueStack npm packages used by 1M weekly users, enabling malware that steals data and controls ...

In the very near future, victory will belong to the savvy blackhat hacker who uses AI to generate code at scale.

Two malicious RubyGems packages posing as popular Fastlane CI/CD plugins redirect Telegram API requests to ...

Security experts discovered over 140 infected GitHub repositories. Out of these, 133 contained working backdoor scripts.

CVE-2025-24016 is far from the only vulnerability to be abused by Mirai botnet variants. In recent attacks, threat actors ...

Sysdig today disclosed an example of how a tool for training artificial intelligence (AI) models was compromised by a cyberattack that led to the ...

Discovered by Sysdig’s Threat Research Team, the malware campaign involved exploiting misconfigured instances of Open WebUI, ...

Unlike legitimate Python debugging tools, dbgpkg lacks any functional debugging ... undetected until those modules are used during runtime. Once triggered, the malicious code checks for an existing ...

The Python Package Index (PyPI), one of the world’s biggest repositories of Python code, is often abused to holst malicious code, or trick software developers into downloading and running tainted code ...

Security researchers at Wiz have uncovered a new campaign called JINX-0132, in which publicly accessible DevOps systems such ...