New attack waves from the 'PhantomRaven' supply-chain campaign are hitting the npm registry, with dozens of malicious packages that exfiltrate sensitive data from JavaScript developers.

Malicious npm package '@openclaw-ai/openclawai' downloaded 178 times installs GhostLoader RAT, stealing credentials and crypto wallets.

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, ...

Researchers say they’ve discovered a supply-chain attack flooding repositories with malicious packages that contain invisible code, a technique that’s flummoxing traditional defenses designed to ...

GitLab exposes abuse of its platform to trick software developers into downloading malicious payloads and finance companies ...

Powered by the TypesScript-native runtime Bun, Electrobun improves Electron with a smaller application footprint and built-in ...

Chainguard, the trusted source for open source, today announced Chainguard Repository, a single Chainguard-managed experience for pulling secure-by-default open source containers, dependencies, OS ...

The infamous GlassWorm malware has infected dozens more Open VSX software packages, according to new research.

Node.jsのメンテナーであるMatteo Collina氏は2026年3月16日、Node.js向けのユーザーランド仮想ファイルシステム@platformatic/vfsを発表し、あわせてNode.jsのコアに仮想ファイルシステムを統合する予定があることを明かした。