Open Source

Compromised npm package silently installs OpenClaw on developer machines

While the AI itself wasn’t weaponized, the technique raises concerns about AI agents with broad system access.

Open source maintainers being targeted by AI agent as part of ‘reputation farming’

AI agent OSS activity opens the door to future supply chain attacks, says security company.

Researchers unearth 30-year-old vulnerability in libpng library

The widely used open-source library has been patched to defend against a heap buffer overflow flaw that’s been in the code since its inception.

Spam flooding npm registry with token stealers still isn’t under control

Goal is to steal Tea tokens by inflating package downloads, possibly for profit when the system can be monetized.

Get a Jump on Reducing Your Open Source Software Security Risks

How GlassWorm wormed its way back into developers’ code — and what it says about open source security

Weeks after being declared eradicated, GlassWorm is again infesting open source extensions using the same invisible Unicode and blockchain C2 tricks.

Malicious packages in npm evade dependency detection through invisible URL links: Report

Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.