Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a ...

Update - 18:55 UTC - The Arch Linux team put up an official announcement now: We are currently experiencing a high volume of malicious package adoptions and updates in the Arch User Repository. We are ...

Monday again. The weekend was meant to be quiet. It wasn't. Last week had poisoned packages, a broken AI helper, and a worm tearing through repos. The ugly part: basic tricks still worked. A chatbot ...

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

Hackers created a fake trading bot for Polymarket’s prediction markets on GitHub. The bot was used to spread malware that ...

Malicious npm packages mimicking Rollup polyfill tooling steal browser data, crypto wallets, and AI tool credentials in a Lazarus-linked campaign.

Mastra AI’s 144 JavaScript packages was executed in just 88 minutes by North Korea’s Sapphire Sleet hacking group, which ...

Microsoft links the recent Mastra AI npm supply chain attack to , a North Korean group known for cryptocurrency theft ...

Gold miners have bounced back like Lazarus on the back of a weak US jobs report and optimism an end to the Iran War is within ...

AI agents are now taking over repetitive work, identifying issues humans may miss, and helping teams maintain testing speed ...

Gold's up-and-down week saw prices jump before retreating, but the ride still delivered strong gains for leading ASX producers.