ChainDrop npm Worm Uses AI Agent Hooks
ChainDrop is an npm worm whose operators planted malicious Claude Code SessionStart hooks and VS Code folderOpen tasks in compromised repositories. The…
Tag: VS Code
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
A credential-stealing npm worm that first appeared in keyv@6.0.0 has spread beyond the Keyv and Cacheable namespaces into hundreds of packages across…
Agent IDE: Suspicious VS Code Extension by Threat Actor
Agent IDE is a Microsoft Visual Studio Code extension published in the official marketplace by a threat actor known as 'johnnysilverhe', who…
Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Microsoft shipped its largest Patch Tuesday on record, addressing 622 CVEs, more than triple the previous high. Two zero-days are under active…
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
Version 8.14.0 of the jscrambler npm package, published on July 11, 2026, shipped with a malicious preinstall hook that silently drops and…
GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code
Researchers Abhishek Kumar and Carsten Maple have discovered a novel workflow-level jailbreak method that bypasses safety guardrails in GitHub Copilot. The study,…
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
North Korean threat actors linked to the Contagious Interview campaign have published 108 unique malicious packages and browser extensions across npm, Packagist,…
TaskJacker: Malicious VS Code Task File Cluster in PolinRider Campaign
A cluster within the PolinRider campaign that drops malicious VS Code task files into GitHub users' repositories. The tasks use 'runOn: folderOpen'…
Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages designed to deploy a Python-based information stealer on…
Fake Font: Malicious npm and Go Packages Disguised as Font Files
A cluster of malicious packages that use fake .woff2 font files to conceal JavaScript payloads. Tactically overlaps with TaskJacker and PolinRider, using…