Self-propagating npm worm steals tokens via postinstall hooks, impacting six packages and expanding supply chain attacks.

OpenFang 0.6.0 brings cron jobs with fan-out, skill templates, and a central registry for slash commands. The framework ...

Lovable's API exposed source code and database credentials for 48 days after the company closed a bug report. Up to 62% of AI ...

The update was announced to all admins via email; they should apply it promptly. Code injection is a risk. As announced on ...