Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

North Korean threat actors are escalating the PolinRider supply chain attack across Go, Packagist, and npm package ...

Microsoft's Dan Wahlin previews his introductory 'Kubernetes for Developers' session at Visual Studio Live! San Diego 2026, explaining how developers can get past the Kubernetes learning curve by ...

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...

A massive supply chain attack infected over 5,500 GitHub repositories to steal user secrets, including CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets, and upload them to ...

Some of the software building blocks shipped under Red Hat’s name spent a stretch of time quietly working against the people who installed them. Hidden inside more than 30 packages in the company’s ...

Miasma campaign infects official Red Hat npm packages, stealing credentials to spread a worm. The malware contains an obfuscated preinstall hook designed to collect a wide range of sensitive data. Per ...

GitHub CISO Alexis Wales confirmed Thursday that a poisoned build of the Nx Console Visual Studio Code extension — live on Microsoft's official Visual Studio Marketplace for just 18 minutes on May 18 ...

GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS Code extension, compromised in last week's TanStack npm supply-chain attack.

GitHub has confirmed that a recent breach into its internal repositories was caused by a vulnerability in a Microsoft Visual Studio Code (VS Code) extension called ‘Nx Console.’ The security team at ...

Attackers apparently had access to GitHub's internal repositories. The operator of the version control platform initially confirmed to the platform Bleeping Computer and later on X that the company ...