Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...

The results were surprisingly good—with a few important caveats. Planning summer travel is hard. Planning it for a busy ...

Indirect prompt injection attacks are now draining cryptocurrency from AI agents in production. Zscaler ThreatLabz documented ...

Wiz's 'GhostApproval' uses an old symlink trick to make six AI coding agents, from Amazon Q to Cursor, write outside the sandbox and hand over the box.

According to Socket, malicious payment SDK packages on npm and PyPI are harvesting developer credentials and CI/CD ...

Now, you can let a simple open-source CLI module turn any command into a GUI for you instead. That’s the solution Jordanian ...

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

They're not bad; they're just prompted that way. Sysdig threat hunters documented what they say is the first-ever documented ...

ParseHawk turns PDFs, scans, images, text, and Markdown into validated JSON. It is built for private document workflows where you want to define the output contract and keep control of files, models, ...

这是一个面向学校网页版 GPT 的 AI 中转站项目。系统把学校 XipuAI 网页版 GPT 封装成统一 API，同时提供一个模仿 ChatGPT ...