Chainguard will use AI to protect open-source code. Athena pools open-source users, developers, and maintainers. Others are also using AI to secure open-source code. As Chainguard puts it, "The gap ...

North Korean hackers are targeting open source software developers with a backdoor and an information stealer as part of a ...

Chainguard will use AI to protect open-source code. Athena pools open-source users, developers, and maintainers. Others are also using AI to secure open-source code. As everyone in IT knows, or should ...

GitHub's npm package manager will ship its most significant security redesign in years this July, when npm v12 makes three long-automatic install behaviors require ...

TL;DR Why EN 303 645 matters ETSI EN 303 645 has given consumer IoT security a much-needed baseline. It gives manufacturers, assessors, and product teams a shared view of reasonable IoT security and ...

Community-run Swift package search engine and metadata index Swift Package Index is joining Apple, but says little is changing for developers in the near term. Here are the details. Most Swift ...

The Swift Package Index is no longer independent as Apple has taken control, but it will remain an open source search engine for third-party code. The Swift Package Index gave developers one trusted ...

The campaign spans npm, Packagist, Go, and Chrome, using obfuscated JavaScript loaders and VS Code tasks to deliver malware.

Fake CVE exploit repos pull frint and skytext packages to steal researcher credentials, with servers still live as of July 1.

Cardano wallet SecondFi traced the incident to an address-level issue and secured 129 million ADA after attackers drained funds from 374 addresses. A vulnerability in Cardano-based wallet SecondFi ...

Socket found a compromised Injective npm package stealing wallet keys amid rising crypto supply chain attacks.