npm Mirrors Are Becoming Phishing Hosts, Not Just Package Mirrors
A fake Cloudflare CAPTCHA campaign used npm packages and mirror CDNs as trusted-looking web hosting. The packages were not the payload; the mirror URLs were.
Developer Security
6 articles
Grok Build Uploaded Entire Git Repositories: What the Wire Capture Proved
A wire-level analysis found Grok Build 0.2.93 uploading tracked source code and full Git history independently of what the agent read. Here is what was proven, what changed, and how developers should respond.
Minimum Package Age: The Supply Chain Control That Buys Defenders Time
Fast takedowns do not protect systems that auto-install malicious packages or extensions in the first minutes after release. Minimum package age turns time into a practical supply chain defense.
The Clean Repo Trap: AI Coding Agents and the Trust Boundary Problem
A 0DIN proof of concept against Claude Code demonstrates how a clean-looking repository can lead to runtime command execution. The structural risk behind the attack applies to any AI coding agent with shell access.
Trump Died of Rabies — And What That Means for Your Package Manager
When DuckDuckGo's AI killed Trump with rabies, the world laughed. When AI coding assistants invent package names, attackers register them. Nobody's laughing then.
GitHub's VS Code Extension Breach: What We Know, What We Don't, and How to Defend
GitHub says an employee device was compromised through a poisoned third-party VS Code extension and internal repositories were exfiltrated. Here is the fact-checked breakdown for defenders.