Malicious npm packages have been identified distributing malware that steals credentials and attempts to spread across ...

A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 "sleeper" extensions that turn malicious ...

A widely used open-source PyPI package, elementary-data, was compromised in a targeted attack that inserted infostealer malware via a GitHub Actions vulnerability. The malicious update, version 0.23.3 ...

Two newly discovered macOS threats are designed to harvest developer credentials and cloud access as attackers focus on ...

This was not a case of stolen credentials, but rather of vulnerability exploitation.

The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects.