Developers will have to contend with a dormant turned active malicious code on Visual Studio Code (VS Code) extensions, which ...

Cybersecurity researchers have flagged a malicious Visual Studio Code (VS Code) extension with basic ransomware capabilities ...

Treat this as an immediate security incident, CISOs advised; researchers say it’s one of the most sophisticated supply chain attacks they’ve seen, and it’s spreading. A month after a self-propagating ...

Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.

The leak has now been fixed. According to the Open VSX team, the incident has been fully contained and closed since October ...

The typosquatted “@acitons/artifact” package targeted GitHub’s CI/CD workflows, stealing tokens and publishing malicious ...

Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.

The Node Package Manager (npm) ecosystem has suffered from two major supply chain attacks in recent months, affecting hundreds of packages and exposing developers to credential theft and data ...

Visual Studio 2026 brings faster performance, new C# and C++ Copilot agents, and seamless compatibility with existing ...

PhantomRaven slipped over a hundred credential-stealing packages into npm A new supply chain attack dubbed PhantomRaven has ...

A threat actor called TigerJack is constantly targeting developers with malicious extensions published on Microsoft's Visual Code (VSCode) marketplace and OpenVSX registry to steal cryptocurrency and ...