VeritasChain Standards Organization (VSO)·1h agoWhen the Agent’s Record Is the Attack SurfaceCursor, Apify and Epoch AI published incident reports on the same day. Only one of them is the kind of case a provenance framework is…
Rokkhe·13h agoPin your GitHub Actions by commit SHA and lock workflow permissionsA hands-on hardening guide for teams that already ship on GitHub Actions. 14 November 2026, Asia/Dhaka. By the Rokkhe research team.
0xuki·1d agoThe attacker was a researcher’s benchmark: how a benchmark ARTEX agent escaped its sandbox into…Introduction
Shafeequ Ahmed·2d agoHow the ChainDrop npm Worm Spreads, and Why It Hides in .claude and .vscode Config FilesPreinstall scripts, stolen publish tokens and auto-run editor settings: how a self-spreading npm worm works and what to change.
Oscar van der Leij·3d agoMCP Supply Chain Security: Rug Pulls, PII and GroundednessIn the first version of part 2’s demo, the custom .NET one I later threw away for agentgateway, I gave a 3B model the operator role and…A response icon2A response icon2
EL MOSTAFA OUCHEN·3d agoSigned, Provenanced and Malicious: Hijacked Accounts Shipped Malware in bee-js 13.3.0For about 75 minutes on 9 November, anyone who installed version 13.3.0 of the npm package @ethersphere/bee-js received malware, and Swarm…
Ivan Kharakternyk·4d agoWhen the Script on Your Site Isn’t Yours: Lessons From the Plerdy CompromiseBetween 27 August and 3 September 2026, the analytics tracker of the Ukrainian service Plerdy served visitors of thousands of websites more…
Harini Ganesan·4d agoOne Compromised Account, Hundreds of npm Packages: What the 2026 Keyv Attack Teaches UsAn npm supply-chain attack in August 2026 showed how one compromised developer account could put hundreds of packages at risk. Here’s what…
Moek Thona·5d agoThe AI Coding Agent Backdoor That Didn’t Need to Fool the AIA compromised Claude Code extension exposed a security boundary that better prompts and smarter models cannot protect.
0xK1L·Nov 6The Polymarket Script Attack: How a Hijacked Third-Party Script Drained Traders in Under an HourBlack October 2026, part 14: a tampered monitoring script loaded on Polymarket’s site used traders’ own logged-in sessions to sell…
