TL;DR A malicious release of TensorLake's TypeScript SDK, tensorlake@0.5.144, used an install hook to search for developer credentials and accept remote commands. Sonatype's code review found that its ...

A report published by Google's Threat Intelligence Group (GTIG) on September 9, 2026, details MCP server hijacking and supply ...

Malicious tensorlake npm version 0.5.144 contained a Shai-Hulud worm that harvests credentials and can republish compromised ...

Seven agencies from four countries published a joint advisory on September 18, 2026, and it carries a finding that matters to anyone who holds their own keys: a North Korean threat group has used fake ...

Spread the loveVisual Studio Code, often simply called VSCode, has become the go-to code editor for developers worldwide. Its flexibility and powerful features make it a favorite among programmers.

Clean up your VS Code setup by replacing these popular extensions with built-in features.

VS Code's tunnel feature is actually useful ...

A group of VS Code theme extensions linked to GlassWorm, a malware campaign targeting developers. Their investigation ...

Hackers use public blockchains as C2 channels for supply chain malware, evading domain blocks and stealing cloud credentials.

Rachel Williams has been an editor for nearly two decades. She has spent the last five years working on small business content to help entrepreneurs start and grow their businesses. She’s well-versed ...

Microsoft's latest update expands agent management, adds cross-platform sandboxing and lets developers pick up AI conversations started in other apps.

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...