#Packages

In May 2026, attackers compromised 42 TanStack packages by poisoning a GitHub Actions build cache...

Michał Górny challenges the stereotype that Gentoo Linux exists only for performance chasing through compilation. The distribution delivers independence from corporate control, strong security practices, surprising stability in a rolling model, and…

Open-source supply-chain trust gate for MCP servers, validated on 200 packages. 3 BLOCK findings including 1 hardcoded LLM API key. 6 'official' servers abandoned. Free public API.

A malicious npm package called ua-parser-js2 impersonated the legitimate ua-parser-js library to steal sensitive files, environment variables, SSH keys, and credentials from developer machines via a post-install script.…

Recent attacks compromised laravel-lang packages and eight others via stolen GitHub credentials and hidden malware in package.json. Packagist's transparency log, Aikido detection, and upcoming immutable versions in Composer 2.10 mark concrete progress…

Most teams find out their dependencies are risky after something breaks. A maintainer disappears, a...

Hu Anyan’s memoir about delivering packages in Beijing is disarmingly direct about the human cost of modern logistics.

A critical vulnerability was published in Nx and some of its supporting libraries. Vercel builds are safe from this vulnerability by default.

Vercel updates that no Vercel-managed systems or internal build processes were impacted by the Shai-Halud 2.0 supply chain compromise

Introducing skills, a CLI for installing and managing agent “skill packages.” Add a skill package with npx skills add , with more commands planned.

Web Analytics and Speed Insights now use resilient intake to improve data collection reliability for all teams.

We audited 31 MCP server packages across npm and PyPI. For each one, we ran two checks: a direct...

Learn how to design modular Swift packages for iOS, enforce clear boundaries, improve code reuse, and speed up CI for large teams.

Figure AI’s Helix 02 humanoid robots neared 40 hours of autonomous work and almost 50,000 packages in a livestreamed warehouse demo.

Okay, story time. Last Tuesday I'm scrolling Twitter (sorry, "X", whatever) and I see the fifth take...

The 'Mini Shai-Hulud' attack compromised 169 npm packages in 6 minutes via poisoned CI cache and valid SLSA signatures.

Attackers stole a limited amount of internal credential material after malware hidden in poisoned packages reached two staff machines

Wire Fire: Episode 01 The Permanent State npm (the open registry that nearly every...