The latest version also executes malicious code during the preinstall phase, and is bigger and faster than the first wave, say researchers. A new version of the Shai-Hulud credentials-stealing ...

Security experts have warned of a major new secret-stealing worm roaming the npm ecosystem which could affect millions of downstream users. Shai-Hulud first appeared in September, when threat actors ...

Researchers found malicious VS Code extensions and Go, npm, and Rust packages stealing developer data via hidden payloads and exfiltration.

A stealthy campaign with 19 extensions on the VSCode Marketplace has been active since February, targeting developers with ...

Rapidly change your password, the Microsoft security team urges as Shai-Hulud Dune Worm cloud attacks continue.

Container image scanning has come a long way over the years, but it still comes with its own set of, often unique, challenges ...

Microsoft previews a GitHub Copilot-powered VS Code Insiders tool that modernizes JavaScript/TypeScript apps by upgrading npm ...

Just over a month after the official release of iOS 26 to the public, Apple is now rolling out iOS 26.1, the first major update to Apple’s new iPhone OS. While the 26.1 update isn’t a huge one, it ...

A new Android Auto version is now available for download for all users; the rollout has now started through the Google Play Store ...

A new Shai-Hulud 2.0 worm is attacking the software supply chain, compromising npm packages, CI/CD systems, and harvesting ...