A threat actor has published hundreds of fake GitHub repositories impersonating legitimate software and security projects to ...

With the ability to take control of distributed devices at scale, HalluSquatting has the potential to achieve various ...

Kaspersky says the attacks use phishing, GitHub-hosted payloads, CVE-2025-9491 LNK abuse, and Go2Tunnel-based tunneling.

Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs ...

One of the largest open-source package repositories just spent a weekend cleaning up after a malware campaign that did not break into anything. It did not need to. Attackers seized control of more ...

Today:Early fog in the far southwest clears quickly. Most areas stay dry with sunshine and variable cloud, though northern and northeastern regions may see isolated showers. Light winds overall, ...

The Arch User Repository lets community members adopt orphaned packages: legitimate projects abandoned by their original maintainers. That process is the entry point for this AUR supply chain attack.

A newly discovered supply-chain campaign called TrapDoor has planted more than 34 malicious packages across npm, PyPI and Crates.io to target crypto and cloud developers. The packages, disguised as ...

A fake repository mimicking OpenAI’s Privacy Filter on Hugging Face accumulated ~244,000 downloads before being removed. It delivered a multi-stage Rust infostealer ...

Today, May 2, 2026, the Zcash Foundation just released Zebra 4.4.0, urging all node operators to upgrade immediately after fixing multiple security flaws, including several that could have split the ...