The Swift Package Index is no longer independent as Apple has taken control, but it will remain an open source search engine for third-party code. The Swift Package Index gave developers one trusted ...

Apple is opening App Store subscription bundles to developers from different companies, giving independent app makers a new way to package services together and sell them at a combined price. The ...

Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI ...

Researchers have uncovered a new Shai-Hulud malware variant targeting Red Hat-related npm packages, spreading through software publishing ecosystems for persistence and credential theft. Developers ...

Supply chain attackers are not only trying to slip malicious code into trusted software. They are trying to steal the access that makes trusted software possible. Recently, three separate campaigns ...

A supply chain attack on SAP-related npm packages has put fresh scrutiny on the developer tools and build workflows that enterprises rely on to produce software. The campaign, referred to as “mini ...

An attacker pushed a malicious version of the popular elementary-data package Python Package Index (PyPI) to steal sensitive developer data and cryptocurrency wallets. The dangerous release is 0.23.3, ...

The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects. Bitwarden ...

As database-driven system development scales up, the number of functions and procedures stored within the server becomes enormous. When these exist individually and in a scattered state, it becomes ...

A major supply chain attack compromised npm packages such as “debug” and “chalk” that are widely used by JavaScript and EthereumJS projects. Attackers injected malicious code that silently swapped ...