4+ hour, 12+ min ago  (962+ words) Version 8.14.0 of the jscrambler npm package shipped with a malicious preinstall hook that silently drops and runs a native infostealer during installation, one build each for Windows, macOS, and Linux. Published on July 11, 2026, it needs no import and no CLI…...

18+ hour, 26+ min ago  (304+ words) CycloneDX + SPDX SBOMs across Python, Node, Maven, and Go with OSV vulnerability correlation, dependency drift, and license/policy CI gating. For security leaders it is a portable, auditable supply-chain check that drops into pre-commit and GitHub Actions, produces a combined…...

1+ day, 8+ hour ago  (477+ words) Injective, the blockchain platform known for its cross-chain DeFi capabilities, announced on X that its security systems detected and neutralized a hacking attempt targeting its npm package. The project confirmed that no user funds were compromised and that the malicious…...

1+ day, 2+ hour ago  (544+ words) Hackers compromised a widely used Injective software package in a supply chain attack with malware designed to steal crypto wallet private keys, adding to a growing attack vector involving attackers using legitimate platforms to deliver malicious payloads. Security firm Socket…...

1+ day, 13+ hour ago  (302+ words) Static analysis scanner for Android APK and iOS IPA files with 130+ SAST rules across 24 check modules, MASVS v2 mapping, and 39 dependency CVEs Because the whole scanner is one ~2,800-line Python file that runs on the 3.8+ standard library alone, it drops into…...

1+ day, 5+ hour ago  (78+ words) OpenMandriva Linux project reportedly targeted in attempted sabotage after contributor dispute SC Media OpenMandriva Linux project reportedly targeted in attempted sabotage after contributor dispute Injective Labs SDK npm package compromised to steal cryptocurrency keys North Korean PolinRider supply chain attack…...

1+ day, 5+ hour ago  (75+ words) Injective Labs SDK npm package compromised to steal cryptocurrency keys SC Media Injective Labs SDK npm package compromised to steal cryptocurrency keys North Korean PolinRider supply chain attack targets 108 unique repos Aikido Security acquires Root.io to enhance open-source software…...

1+ day, 18+ hour ago  (344+ words) Multi-language SAST covering Java, PHP, Python, MERN, and OWASP LLM Top 10 with 200+ rules, 80+ dependency CVEs, and M365 SSPM It is built for AppSec engineers, DevSecOps teams, and consultants who want a fast, auditable, dependency-free way to gate merges (exit code 1 on…...

1+ day, 11+ hour ago  (290+ words) Software supply chain attacks have become more common, with attackers increasingly targeting trusted developer tools instead of end users. In the latest incident, attackers compromised a trusted Injective Labs software package to steal developers’ wallet credentials. The attacker uploaded a…...

1+ day, 16+ hour ago  (436+ words) IBM is adding new capabilities to its AI platform Bob, enabling organizations not only to generate code but also to support the entire software development cycle. The expansion focuses on collaboration between multiple AI agents, parallel task processing, and better…...