Tenable Research investigated a malicious package in the npm public registry named “amber-src” that underscores the rapid ...

Warper 7.2 is a cutting-edge open-source React virtualization library utilizing Rust and WebAssembly for unmatched performance. With zero-allocation hot paths and O(1) circular buffer operations, ...

A malicious NPM package, ambar-src, mimicking a popular JavaScript framework, was downloaded nearly 50,000 times in a few ...

Security researchers at Microsoft said the campaign targets developers who routinely clone public repositories for evaluation, collaboration or recruitment exercises. The attackers publish projects ...

The module targets Claude Code, Claude Desktop, Cursor, Microsoft Visual Studio Code (VS Code) Continue, and Windsurf. It also harvests API keys for nine large language models (LLM) providers: ...

Cline CLI 2.3.0 was published with a stolen npm token, installing OpenClaw in an 8-hour attack affecting ~4,000 downloads.

The malicious version of Cline's npm package — 2.3.0 — was downloaded more than 4,000 times before it was removed.

The npm registry now includes Socket security analysis links directly on package pages to help developers assess supply chain risks.

Microsoft is previewing an open-source command-line tool designed to speed up Windows application development, testing, and delivery.

Local AI agents and a gaming handheld - what could possibly go wrong?

Researchers have revealed that bad actors are targeting dYdX and using malicious packages to empty its user wallets. According to the report, some open source packages published on the npm and PyPi ...