unite

Anaconda Acquires Kilo Code to Expand Into Agentic Software Development

Anaconda has acquired Kilo Code, an open-source, model-agnostic platform that embeds AI agents into the tools developers use to build software. The deal brings Kilo’s community of more than three ...
Microsoft

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...
The Next Web

Upwind links compromise of multiple AsyncAPI npm packages to coordinated attack on software release process

Upwind traces multiple compromised AsyncAPI npm packages to a coordinated supply chain attack targeting software release pipelines and publishing identities.
SD Times

IBM and Red Hat Expand Lightwell with New Offerings to Build the Trust Infrastructure for AI-Era Open Source

RALEIGH, N.C. and ARMONK, N.Y. — IBM and Red Hat today announced the commercial launch of Lightwell, delivering automated vulnerability remediation at scale through two offerings: Lightwell Network ...
Developer Tech

Socket: PyPI and npm payment SDK malware compromises CI/CD

According to Socket, malicious payment SDK packages on npm and PyPI are harvesting developer credentials and CI/CD ...
Opinion
Database Trends and ApplicationsOpinion

RapidFort and ReversingLabs Introduce Open-Source Dependency Libraries Providing Safe Package Catalogs

RapidFort, a leader in software supply chain security with the largest distribution of curated truly open-source software, and ReversingLabs (RL), the trusted name in file and software security, ...
Developer Tech

FBI warns developers over TeamPCP software supply chain attacks

The FBI warned that TeamPCP software supply chain attacks targeted developer tools to steal cloud credentials, SSH keys, and ...
Tech Times

New APT Group Hits Power Grids in Three Countries with AI-Crafted Malware

Armored Likho BusySnake Stealer, a Python-based infostealer first disclosed by Kaspersky, is actively targeting government ...
Windows Report

Malicious PyPI Packages Let Hackers Control Telegram Bot Servers

Operation Navy Ghost is targeting Python developers who build Telegram bots by hiding backdoors inside trojanized Pyrogram forks uploaded to PyPI. The campaign has been active since November 2025, ...
Bleeping Computer

Malicious PyPI packages give hackers control of Telegram bot servers

A campaign active since last November has been targeting Python developers building Telegram bots with trojanized Pyrogram forks that allow attackers to read arbitrary files on compromised servers. At ...

digna Introduces Python SDK and Docker Deployment in Release 2026.06

Vienna, Austria, June 25, 2026 — digna, the European data quality and observability platform, today announced the release of digna 2026.06, introducing a new Python SDK and Docker deployment support ...

Millions of AI agents imperiled by critical vulnerability in open source package

Millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and ...