A version of the AI coding tool in Anthropic's npm registry included a source map file, which leads to the full proprietary ...

The design flaw in Flowise’s Custom MCP node has allowed attackers to execute arbitrary JavaScript through unvalidated ...

Anthropic has accidentally exposed Claude Code's full 512,000-line TypeScript source via an npm source map, revealing ...

De veelgebruikte axios-library voor JavaScript-code is gehackt en wordt gebruikt voor een supplychainaanval. Gebruikers van ...

Google links Axios npm supply chain attack to UNC1069 after trojanized versions 1.14.1 and 0.30.4 spread WAVESHAPER.V2, ...

An attacker compromised the npm account of a lead Axios maintainer on March 30, and used it to publish two malicious versions ...

Attackers stole a long-lived npm token from the lead axios maintainer and published two poisoned versions that drop a ...

Anthropic's Claude Code CLI had its full TypeScript source exposed after a source map file was accidentally included in ...

A new wave of device code phishing shows how threat actors are scaling account compromise using AI and end‑to‑end automation.

OpenClaw's Node for VS Code extension proved it can support a real local file-based workflow, but on Windows the experience still feels more like early infrastructure than finished tooling.

Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying ...

Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver ...