An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by ...

Thirteen npm packages deliver WeaselBiscuit, a JavaScript stealer that harvests Chrome extension storage across Windows, macOS, and Linux.

Threat actors are exploiting CVE-2026-58138, a critical-severity remote code execution vulnerability in Orkes Conductor.

The research examines how building from source, enforcing provenance and applying layered security controls can significantly reduce exposure to open-source malware. What you'll discover Where malicio ...

A bug-hunting independent security research team was able to access OpenAI’s internal code system, exposing growing risks in ...

The campaign allegedly involved an OpenAI agent swarm and abused package documentation systems, metadata fields, and registry ...

Trellix highlighted findings from its latest Trellix SecondSight Threat Hunting Report with implications for Indian organizations. Examining five critical campaigns observed between January and June ...

Two China-linked groups ran identical Chrome/Windows zero-day exploits against NGOs, deploying different backdoors each.

DarkSword, JSCeal, Axios, Bitter APT, and APT28 campaigns reveal evolving tactics targeting iPhones, Southeast Asia, software ...