The leak has now been fixed. According to the Open VSX team, the incident has been fully contained and closed since October ...

Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.

Currently in private beta, the GPT-5-powered security agent scans, reasons, and patches software like a real researcher, ...

It has been a busy week for supply-chain attacks targeting open source software available in public repositories, with successful breaches of multiple developer accounts that resulted in malicious ...

A threat actor called TigerJack is constantly targeting developers with malicious extensions published on Microsoft's Visual Code (VSCode) marketplace and OpenVSX registry to steal cryptocurrency and ...