AI models weigh credibility heavily. Mentions in respected media outlets, research publications or industry databases reinfo ...

In a supply chain attack, attackers injected malware into NPM packages with over 2.6 billion weekly downloads after ...

Qix is an open source maintainer account that was compromised by a phishing attack. This allowed attackers to infect 18 popular npm packages with malicious code. Together, these packages are ...

Cross-Origin Resource Sharing (CORS) issues have long been a nightmare for front-end developers, especially when building complex Javaapplications. Traditional solutions, such as ...

JavaScript’s low bar to entry has resulted in one of the richest programming language ecosystems in the world. This month’s report celebrates the bounty, while also highlighting a recent example of ...

What could have been a historic supply chain attack seems to have been averted due to the rapid response of the open source ...

Dr. James McCaffrey presents a complete end-to-end demonstration of the kernel ridge regression technique to predict a single ...

On September 8, 2025, a single phishing email triggered one of npm’s most damaging supply chain attacks, compromising 18 ...

An escalating npm supply chain attack has compromised dozens of foundational JavaScript packages to spread malware and drain crypto wallets.

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals ...