A malicious version of the PyTorch Lightning package published on the Python Package Index (PyPI) delivers a ...

A single line of Python code was all it took. Developers who ran import lightning after installing versions 2.6.2 or 2.6.3 of ...

The Zig Software Foundation has reinforced its blanket ban on LLM-authored issues and pull requests, and Bun’s 4x Bun-compile ...

Malicious Lightning 2.6.2/2.6.3 released April 30 enable credential theft via hidden payload, leading to PyPI quarantine and ...

SAP npm packages poisoned on April 29, 2026 + AES-256-GCM encrypted credential theft + AI coding tools abused for spread.

ThreatDown’s EDR team discovered a sophisticated, multi-stage attack chain during an active investigation; the first documented case of attackers abusing the Deno runtime as a malware execution ...

Bun, acquired by Anthropic in December 2025, is both a bundler for compiling TypeScript or JavaScript applications for the ...

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources. Dany Lepage discusses the architectural ...

A supply-chain attack affecting Axios, the popular JavaScript library, traced back to DPRK threat activity. (Image: Shutterstock) A supply-chain attack that compromised versions of Axios to distribute ...

Better burger brand Patty & Bun has closed four of its London restaurants, including its original site on Marylebone’s James Street. The other closures are on Clapham’s Northcote Road, Soho’s Kingly ...