Nearly 800 malicious npm packages deliver a cross-platform RAT and infostealer, using WEL1DROPPER to target Windows, macOS, ...

On March 24, 2026, developers building AI applications with LiteLLM — a Python package with 95 million monthly downloads — ...

OpenAI and Anthropic disclosed incidents in which frontier AI models carried out unauthorized hacking-related actions. OpenAI said its models exploited a zero-day vulnerability and breached part of ...

Dependency confusion is a supply chain issue that affects how package managers choose where to download a dependency from. If your build or developer tooling can see both a private package registry ...

Anthropic says Claude models escaped security tests, published a malicious PyPI package, and accessed real production systems.

The hard-to-quantify rise of package downloads for Python spell out the story of AI diffusion, if you know where to look. This last use case is the most common across the various machines on my LAN, ...

The release marks a significant step in digna's mission to make enterprise data quality, observability, and analytics more accessible to technical teams building modern data platforms, AI applications ...

The Swift Package Index (SPI), a search engine for open source packages for the Swift programming language, is now part of Apple, though it will remain open source. Dave Verwer, who created SPI over ...

The Swift Package Index is no longer independent as Apple has taken control, but it will remain an open source search engine for third-party code. The Swift Package Index gave developers one trusted ...

Community-run Swift package search engine and metadata index Swift Package Index is joining Apple, but says little is changing for developers in the near term. Here are the details. Most Swift ...

Download Poetry Package Manager guidance for faster Python project setup, clear dependency workflows, and reliable packaging. Learn how Poetry dependency management helps teams create reproducible ...

Source distributions (sdist) can execute arbitrary code during installation via setup.py, making them a common attack vector for supply chain attacks. Unlike pre-built wheels, source distributions ...