TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious ...

TeamPCP’s Mini Shai-Hulud campaign used hijacked GitHub OIDC tokens to spread a credential-stealing worm through TanStack npm ...

A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary ...

Fake OpenAI Privacy Filter hit #1 on Hugging Face with 244,000 downloads, spreading infostealer malware to Windows users.

The repository reached the #1 trending position on Hugging Face within 18 hours, highlighting how public AI repositories are ...

Zaid Al Hamani, CEO and Founder of Boost Security, is a cybersecurity and DevSecOps leader with over two decades of ...

If you thought Roblox Studio's new 2026 agentic AI features were the end of the road for manual scripting, think again. While the platform now promises to turn text prompts into full game designs, the ...

Attackers are posting fake macOS troubleshooting guides to trick users into running malicious Terminal commands that steal crypto. The campaign has been active since late 2025 and bypasses Gatekeeper ...

An attacker has published 84 malicious versions of official TanStack npm packages, with the impact including credential theft ...

A script is just a collection of commands saved into a text file (using the special .ps1 extension) that PowerShell understands and executes in sequence to perform different actions. In this post, we ...

Thirteen critical vulnerabilities have been found in the vm2 JavaScript sandbox package that could allow an attacker’s code ...