How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings
Download pumping: New npm deception technique for supply chain attacks
Learn how attackers exploit automated bot traffic as part of software supply chain attacks to artificially inflate download counters and mask malicious payloads as legitimate.
The Axios supply chain attack used individually targeted social engineering
The Axios team have published a full postmortem on the supply chain attack which resulted in a malware dependency going out in a release the other day, and it involved …
Features everyone should steal from npmx
What happens when users design their own package registry frontend
Dependency cooldowns turn you into a free-rider
Against dependency cooldowns as a response to supply chain attacks
npmx - Package Browser for the npm Registry
a fast, modern browser for the npm registry. Search, browse, and explore packages with a modern interface.
Department of Homeland Security AI Use Case Inventory
All data presented in this tracker is drawn directly from the DHS AI Use Case Inventory published by the Department of Homeland Security. The information is reproduced as provided in the source file and has not been independently verified, including statements on safety and impact. This presentation may contain errors or omissions. Users should consult the original DHS source file for authoritative data. The comparison view identifies differences between the 2024 Inventory July Revision and 2025 Inventory releases; some field differences reflect changes in the reporting format rather than substantive changes to the use cases.
A GitHub Issue Title Compromised 4,000 Developer Machines
A prompt injection in a GitHub issue triggered a chain reaction that ended with 4,000 developers getting OpenClaw installed without consent. The attack composes well-understood vulnerabilities into something new: one AI tool bootstrapping another.
You're Invited: Delivering malware via Google Calendar invites and PUAs
Threat actor used malicious Google Invites and hidden Unicode “Private Use Access” characters (PUAs) to brilliantly obfuscate and hide a malicious NPM package.
.png)
Anthropic Drops Flagship Safety Pledge
In an abrupt shift, the company may release future AI models without ironclad safety guarantees
Protecting our FLOSS commons from LLMs — Codeberg News
In Brief: Two motions regarding
“Policy Without Tools Is Just Poetry” - AT Protocol
Juliet Shen from ROOST joins the show to talk through the Coop 1.0 release, what open-source trust and safety unlocks for new builders, and where AI actually belongs in moderation
‘Doom Loop’: OpenAI and Microsoft Admits LLMs Are Destroying the Web and Built on Theft
"Millions of people around the world will soon consider large models ‘hoovering up’ all their work to be an astonishing theft of unprecedented proportions."
On Betraying Principles
Why Creative Commons must be about more than reducing friction on reuse This week, I had the experience of being told the work we are doing at Creative Commons right now is betraying the founding principles of the organization. This is not the first time and it won’t be the last.
Just a rumour of a bug is enough to find a security exploit these days
Thinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond
202605 - apenwarr
In recent months I've heard of several teams with an interesting policy: each pull request should be no more than a few files, and no more than a certain number of lines (say 500). And do just one thing and do it well. And be easy for a human to review. And be fully tested by the test suite.