The set mirrors collected malware. Across the OSV-confirmed npm packages shipping a binary, formats are PE, ELF (all stripped ...

A new open-source tool uses neural embeddings to index 1.29 million code entities across more than 2,500 MediaWiki ...

The tool's HTML preview mechanism had a flaw allowing malicious JavaScript to access local files and exfiltrate cloud ...

REA, an open-source MCP server that allows AI agents to analyze and decompile binaries, has been released. When combined with ...

Two newly disclosed vulnerabilities in Discourse let unauthenticated attackers execute JavaScript against anonymous visitors ...

Malicious tensorlake npm version 0.5.144 contained a Shai-Hulud worm that harvests credentials and can republish compromised ...

Mythos AI found a critical Rejetto HFS flaw enabling admin-session forgery and arbitrary code execution via predictable Math.random() keys.

GlassWorm-linked VS Code extensions abuse theme packages, obfuscated JavaScript, AES-256-CBC, and Solana dead drops to ...

A group of VS Code theme extensions linked to GlassWorm, a malware campaign targeting developers. Their investigation ...

Tech Radar disclosed that security researchers have successfully bypassed the prompt-injection protections of an AI agent named Manus, achieving code execution through a sophisticated obfuscation ...

Researchers found a way around Manus' guardrails and got it to execute a simple email prompt injection attack.