Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver ...

The leak provides competitors—from established giants to nimble rivals like Cursor—a literal blueprint for how to build a ...

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions. Evidence ...

North Korean hackers exploit VS Code tasks.json auto-run since Dec 2025 to deploy StoatWaffle malware, stealing data and ...

Getting a random package you didn't order used to be either a shipping mistake or a mildly annoying marketing ploy. Now it might be something worse, the FBI has warned in a public service announcement ...

QR codes are built into the modern internet experience. You point your phone at the square with a strange pattern, and it'll load a website on your phone, which will offer specific information. But ...

Threat actors hijacked the popular npm package axios to spread RAT malware after compromising an open‑source maintainer’s ...

Security teams are grappling with a major supply chain attack on Axios, a popular JavaScript library with over 100 million ...

UNC1069 compromised Axios 1.14.1 and 0.30.4 via social engineering, impacting 100M weekly downloads and exposing supply ...

The exposure traces back to version 2.1.88 of the @anthropic-ai/claude-code package on npm, which was published with a 59.8MB ...