JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Microsoft shipped four VS Code releases across May and early June 2026 — versions 1.120 through 1.123 — that together crossed a threshold the company had been approaching for more than a year: ...

VS Code version 1.122 is the final release to support pre-built VS Code server support for 32-bit ARM Linux hosts. From 1.123 onwards, an x86_64 or ARM64 (64-bit) Linux environment will be required ...

Noteworthy stories that might have slipped under the radar: Trump Mobile exposes customer data, phishers target the 2026 FIFA World Cup, CISA responds to recent supply chain attacks. SecurityWeek’s ...

A GitHub employee installed a routine VS Code extension update on the morning of May 18, 2026. That single action handed cybercrime group TeamPCP enough access to exfiltrate approximately 3,800 of ...

Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code (VS Code) Marketplace. The extension in question is ...

Any development environment that installed or imported one of the 172 compromised npm or PyPI packages published since May 11 should be treated as potentially compromised. On affected developer ...

Checkmarx, a security company offering tools for developers, has been compromised for a second time in a month. The hackers injected credential-stealing malware into popular free software, including ...

Preview of new companion app allows developers to run multiple agent sessions in parallel across multiple repos and iterate on human and agent reviews. Visual Studio Code 1.115, the latest release of ...

OpenClaw, an open source AI agent, offers users the ability to automate tasks and integrate AI-driven solutions into their workflows. However, setting it up securely in a cloud-based environment can ...