The OWASP-backed tool scans JavaScript and TypeScript lockfiles locally, aiming to help developers catch and remediate dependency risks before CI failures.

TrapDoor spread 34 malicious packages across npm, PyPI, and Crates.io, stealing developer credentials and enabling persistence.

Ghostwriter used Prometheus lures since spring 2026 to target Ukraine agencies, enabling malware delivery and data theft.

TanStack tightens security measures after supply chain attacks. Pull requests may soon only be possible by invitation.

Anthropic acquired Stainless, the SDK compiler behind OpenAI, Gemini and Llama. The deal hands one AI lab structural leverage ...

Activities to do with the kids this weekend, courtesy of The Frederick Mom.

I built a coding tutor that won't let me cheat my way through it. Here's the prompt.