keyv npm supply chain attack on August 4, 2026 let the Shai-Hulud worm compromise 400-plus packages and more than two billion ...

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...

GitHub Code Quality billing starts today as the free preview ends, with immediate $10-per-active-committer monthly charges hitting more than 10,000 enterprises and no grace period. The three-part bill ...

In June 2026, researchers at Novee Security disclosed a class of CI/CD weakness they named Cordyceps. They scanned roughly 30,000 high-impact repositories across the npm, PyPI, crates.io, and Go ...

Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family that has compromised a new set of npm packages, ...

GitHub has released GitHub Agentic Workflows in public preview, adding support for coding agents inside GitHub Actions. The public preview follows a technical preview GitHub announced in February. At ...

在 AI 代码审计任务中，agent 经常会在最终报告中声称“已完成审计”或“未发现明显问题”。但对使用者来说，一个关键问题并不透明：AI 到底获取过哪些代码？它是系统性阅读了关键模块，还是只通过少量关键字搜索结果就推断整个目标安全？ 因此可以引入 ...

Microsoft Threat Intelligence discovered that Anthropic’s Claude Code GitHub Action could expose CI/CD workflow secrets when AI agents process untrusted GitHub content, including issue bodies, pull ...

Cloudflare Inc. today said it has acquired VoidZero Inc., the open-source company behind Vite and the widely used JavaScript build tools that surround it, in a move to position its developer platform ...

At the Microsoft Build 2026, Microsoft unveiled the new GitHub Copilot app, a dedicated desktop experience designed specifically for what it calls “agent-native development.” Rather than treating AI ...

An audience member seated near a Microsoft logo listens as Microsoft Chairman and Chief Executive Officer Satya Nadella speaks during the Microsoft Build conference opening keynote in Seattle, ...

VS Code 1.122 removes the GitHub sign-in blocker for BYOK, making enterprise and offline AI workflows practical. BYOK now supports chat, tools and MCP servers while signed out. The release also ...