The Hacker News

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Malicious Solidity Pro VS Code extensions steal crypto wallets, API keys, SSH keys, and developer tokens, then exfiltrate the ...
InfoQ中国 on MSN

微软发布搭载原生 Go 编译器的 TypeScript 7.0，构建速度提升 10 倍

微软发布 TypeScript 7.0，这是该语言首个搭载其研发已久的原生编译器的稳定版本。该编译器将 TypeScript 工具集移植到了 Go 语言。据开发团队称，在完整的构建过程中，该版本通常能带来 8 倍至 12 倍的速度提升。
Developer Tech

npm supply-chain attack hits 400+ packages and steals developer credentials

A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.
Tech Times on MSN

Keyv npm supply chain attack hides malware in AI agent files scanners never read

keyv npm supply chain attack on August 4, 2026 let the Shai-Hulud worm compromise 400-plus packages and more than two billion ...
The Hacker News

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

Open VSX removes 77 evil twin extensions that impersonate developer tools and exfiltrate host, workspace, Git, and CI data.
Microsoft

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...
Developer Tech

Aikido Security tracks Shai-Hulud npm package infection surge

Aikido Security says an npm supply chain attack has infected Keyv packages with a variant of the credential-stealing ...
GitHub

Kimi Code CLI Launcher for VS Code

Kimi Code CLI Launcher for VS Code is a lightweight, unofficial VS Code extension that starts the Kimi Code CLI AI coding agent directly from the editor toolbar. One click opens kimi in a new side ...