Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in ...

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

Microsoft says hotel phishing emails are using Calendly links and photo ZIP files to drop the TonRAT Node.js implant on front ...

Separate but similar campaigns described by Microsoft and Trend Micro use malicious zip files to spread malware via social ...

The next major release of Deno, a JavaScript/TypeScript runtime, will include new commands to build cross-platform desktop ...

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Mastra AI’s 144 JavaScript packages was executed in just 88 minutes by North Korea’s Sapphire Sleet hacking group, which ...

With npm v12, GitHub closes a central attack vector: installation scripts from dependencies will only run after explicit approval from July 2026.

Microsoft is delivering tools to quickly configure Windows PCs as workstations for Windows and Linux development.

A malicious Chromium-based extension that spoofs the AI-powered answer engine Perplexity AI redirects browser search traffic using MV3 APIs and intermediary infrastructure.

On QoreChain mainnet (qorechain-vladi), a 1,000 QOR transfer to a wallet created in Keplr is the first mainnet transaction to settle on a fully post-quantum foundation: an ML-DSA-87 (Dilithium-5) ...