A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation
Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sur…
Последние новости
⚑ Сообщить о проблемеTech news from the best sources
Все темы
- игры
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
What Is JINGDONG Logistics and How Does JD Logistics Use AI in Supply Chain Management?
When people hear about JINGDONG Logistics, also known as JD Logistics, they may think of package delivery. But delivery is only one part of what the…
Image verification, one layer below admission
Every admission webhook you rely on has an escape hatch. Nothing scandalous about that, it is just how Kubernetes wires them up. A CNCF post on July…
PyPI stops accepting late file uploads to releases older than 14 days
PyPI now rejects new file uploads against any release older than 14 days, closing off a small but useful window that a compromised publishing token…
Booking.com Breach: When the Vendor Chain Becomes the Attack Surface
What Happened This week, Booking.com confirmed that unauthorized third parties accessed reservation data belonging to a subset of customers. Exposed…
Dependabot learns to wait: version-update PRs now sit for three days by default
Every time your bot merges a two-hour-old release into main, you are trusting a stranger's freshly published tarball to be the same one everyone els…
Innersource security advisories go GA: a private channel for private vulns
Your platform team ships an internal package. Half the org pulls it. Someone finds a bug that in the wrong hands is a full RCE. What do you do next:…
uv audit vs pip-audit, and a gate narrower than it looks
Until now, the tools that install packages have never once stopped to ask, "Are you sure it's okay to take this one?" Whether it's pip install or np…
MCP supply chain attacks are coming — here's how to prepare
The npm incident, but for AI agents Remember when malicious npm packages stole crypto wallets? The same thing is coming for MCP servers. An MCP serv…
From vexctl scripts to a governed VEX platform: building vex-ui with Next.js, keyless signing, and a Trivy-consumable repo
un Trivy against almost any vendor container image and you'll get a wall of findings. Most of them don't matter, the vulnerable code path is never e…
Aikido buys Root to patch open source in place, without the upgrade dance
Every open-source CVE backlog has that one line item you keep sliding into next quarter. The library is a couple of majors behind, the upgrade break…
CI is the wrong place to first hear about your npm dependencies
Your CI catches the npm vulnerability. Your developer is already three branches away and one standup behind. The package is installed, the lockfile…
A Rogue Registry in My Own Backyard: Anatomy of a Two-Line Supply Chain Attack
The previous parts of this series were written from a comfortable distance. I read the Trend Micro diagrams about Shai-Hulud, I theorised about Dock…
Cilium publishes its CI hardening playbook, gaps and all
Every open source project's CI pipeline is a quiet confession of how much trust it extends to its own contributors. (Most maintainers would rather y…
Homebrew 6.0.0 turns third-party taps into an opt-in trust list
Your CI runner is a stranger with a credit card and root. Every brew install against a third-party tap is the same trust gesture as curl | sh , just…
One npm Account Publishes 964 Million Downloads Per Week. None Have Provenance.
The npm account ai publishes seven packages. Combined, they install 964 million times per week: Package Weekly downloads Publishers Risk postcss 245…
IronWorm Commits as 'claude.' It Steals Your Anthropic and OpenAI Keys.
On June 3, JFrog Security Research published their analysis of IronWorm — a supply chain attack that compromised 37 npm packages through the asteroi…
How to Build a Secure Homelab for LLM Inference
We’ve treated local AI deployments as experimental toys for too long. The moment a homelab becomes a dependency for work, the security posture must…
ShadowFeed Weekly #1: IronWorm npm Attack, $36M Humanity Protocol Hack, Microsoft Repos Compromised
ShadowFeed Weekly #1 | Web3 Security Intelligence June 5 — June 11, 2026 ShadowFeed is a real-time Web3 security intelligence service for developers…
Rust Crate 'onering' Compromised: Malicious Code Exfiltration Risk Mitigated with Updated Version
Introduction and Background The Rust ecosystem, celebrated for its memory safety and performance, relies heavily on crates —its package management s…
End-to-End GitHub Security Hardening Guide for Organizations
GitHub is not just a source code platform anymore. For most engineering organizations, GitHub is part identity system, part software supply chain, p…
The Maintainer Trap: What the jqwik Incident Reveals About Trusting Your Dependencies
This article was originally published on LucidShark Blog . On May 29, 2026, a developer pushed a new release of jqwik, a popular Java property-based…
The Bot That Never Was
By Ionut-Cristian Florescu ( @icflorescu ), written June 6, 2026, while still locked out. How the Miasma worm, a Shai-Hulud strain that this week al…
Supply Chain Sense: Merging Gemini AI and Math for Smart Retail Inventory
In neighbourhood retail markets, local Kirana stores, and hyper-local fulfilment centres, inventory management isn’t an administrative task—it’s a h…
I scanned 200 popular MCP server packages. Here is what I found.
The MCP ecosystem has been growing fast, but the supply-chain hygiene has not kept up. MCPwn (CVE-2026-33032, CVSS 9.8) exposed 2,600+ instances. Th…
Mini Shai-Hulud: A persistent supply-chain worm
On April 29th, Aikido researchers detected multiple compromised Node.js packages in SAP's namespace today. The malware adapts to CI environments, st…
How `shieldcortex audit --deps` Catches the parikhpreyash4 Supply-Chain Attack
Socket Security flagged a campaign yesterday: roughly 700 GitHub repositories carrying a poisoned package.json that drops /tmp/.sshd , pipes curl -s…
npm Supply Chain Audit: The Checklist Most Teams Stop Too Early
Originally posted on getcommit.dev . In October 2021, ua-parser-js was used by Facebook, Microsoft, Amazon, and Google. It had 7 million weekly down…
PCB Shortage Warning: Iran-Saudi Conflict Drives 40% Price Increase — What Hardware Engineers Need to Know
Gulf Conflict Triggers New PCB Supply Chain Crisis A convergence of geopolitical disruption and commodity price surges is creating the PCB industry'…
Causa GitHub, or: Your Editor Extensions Run as You
Wire Fire — Episode 02 On 18 May 2026 an attacker published a poisoned version of a popular Visual Studio Code extension. It was live for roughly el…