The biggest story of the week is a new massive supply chain breach, which appears to be unrelated to the previous massive supply chain breaches, this time of the Axios HTTP project. Axios was ...

In-house software built in March with open-source components may include malware placed there by criminals. This isn’t a ...

A large-scale phishing campaign is currently targeting developers via GitHub. Attackers are exploiting the Discussions feature to spread fake security ...

This is GlassWorm: a software supply chain attack that security researchers are calling one of the most sophisticated and ...

Preview of new companion app allows developers to run multiple agent sessions in parallel across multiple repos and iterate ...

Latest weekly update supports previewing videos in the image carousel, adds a Copy Final Response command to the chat context ...

Attackers stole a long-lived npm token from the lead axios maintainer and published two poisoned versions that drop a ...

OpenClaw's Node for VS Code extension proved it can support a real local file-based workflow, but on Windows the experience still feels more like early infrastructure than finished tooling.

Omar Shahine's new Microsoft role focused on bringing OpenClaw and personal agents to Microsoft 365 adds weight to the workplace-assistant story for the open-source AI framework, even as its current ...

The AppsFlyer Web SDK was temporarily hijacked this week with malicious code used to steal cryptocurrency in a supply-chain attack. The payload can intercept cryptocurrency wallet addresses entered on ...

The popular JavaScript HTTP client Axios has been compromised in a supply chain attack, exposing projects to malware through ...