JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Lapse… so does this $25 Raspberry Pi Zero! Tiny, lightweight, and incredibly versatile. Mount it anywhere—from rooftops to ...

This week's ThreatsDay Bulletin covers curl flaws, a critical Hoppscotch bug, smart TV proxyware, macOS ClickFix attacks, ...

My AI stopped having goldfish syndrome.

A developer went viral for reconfiguring Chipotle’s customer support bot into a coding assistant, and providing the playbook for others to do the same to other chatbots.

[Editor’s Note: Agents of Transformation is an independent GeekWire series, underwritten by Accenture, exploring the adoption and impact of AI and agents. See coverage of our related event.] A team ...

Credential theft fell to 13% of breach vectors in 2026. Attackers now bypass MFA via help desk resets and OAuth token theft. Five attack surfaces mapped.

A threat actor targeting Microsoft 365 and Azure production environments is stealing data in attacks that abuse legitimate applications and administration features. Microsoft tracks the actor as Storm ...

Silicon Valley’s tokenmaxxing era now has its own hardware. A new open source project brings your Claude Code utilization stats into a tiny desktop dashboard, allowing AI power users to keep an eye on ...

Any development environment that installed or imported one of the 172 compromised npm or PyPI packages published since May 11 should be treated as potentially compromised. On affected developer ...

Replaced Chapter 8 brings you back to Warren's Phoenix-City apartment to find anything that could help with REACH's current situation. Near the end of the chapter, there's a locked safe that you need ...

Attackers published a malicious command-line version of the popular open-source password manager to the npm registry and may be behind a spate of recent supply chain attacks. Researchers warn of a new ...