Tag: developer security
A placeholder web address in 1,700 repos now serves malware
The documentation stand-in third-party[.]com has been weaponised, serving a ClickFix lure that poisons the clipboard on Windows machines.
Fake recruiters call Rust maintainers to plant malware on their Macs
Fake recruiters are booking video calls with Rust maintainers and pushing malware.
A lighter stealer called WeaselBiscuit turns up in 13 npm packages
A small JavaScript stealer with fingerprints of North Korean developer-targeting campaigns has been found riding a cluster of malicious packages.
Self-propagating npm worm poisons 400-plus packages via stolen tokens
The Mini Shai-Hulud worm stole publisher credentials, republished tainted packages, and burrowed into AI coding tools.
AsyncAPI npm packages with millions of weekly downloads compromised via GitHub actions
Five AsyncAPI npm packages with 2.9 million weekly downloads were trojanized after a GitHub Actions token theft.
New Attack Exploits AI Coding Agents via Sentry Error Platform
Tenet Security researchers discovered a technique called Agentjacking that uses crafted Sentry error reports to trick AI coding assistants into…
Over 1,800 Developers Compromised in Mini Shai-Hulud Supply Chain Attack
The threat actors infiltrated legitimate npm packages for SAP, Lightning, and Intercom to deploy credential-harvesting code, compromising over 1,800 developers.