Trojanized Terraform Provider Delivers Cross-Platform Backdoors to Developers
A malicious Terraform provider masquerading as an AWS plugin delivers FLATROOF and ROOFDECK malware across macOS, Linux, and Windows. The campaign targets developer and CI/CD environments where cloud...
Encrypted Prompt Injection Can Turn Copilot CLI Into a Developer-Secret Exfiltration Tool
Researchers demonstrated how encrypted instructions on a hostile web page could lead Copilot CLI in autopilot mode to read local files and transmit secrets. The finding shows why...
GlassWorm Hides Malware Inside VS Code Themes to Target Developer Workstations
GlassWorm operators used convincing VS Code theme extensions to conceal downloaders, encrypted JavaScript and blockchain-based payload routing. Developer teams should remove confirmed malicious packages and investigate hosts because...
GitSpawn Turns Booby-Trapped Repositories Into Silent Code Execution Across AI Coding Tools
GitSpawn weaknesses allow specially prepared project folders to execute local commands when AI coding agents perform routine Git checks. Several vendors have patched variants, but researchers say four...
One Click, Total Takeover: The RCE Bug That Hid Inside Cursor, VS Code, and Google Antigravity
Security researchers at AISLE uncovered a one-click remote code execution flaw shared by Cursor, Microsoft VS Code, and Google Antigravity, all three built on the same underlying codebase....
Shai-Hulud Malware Expands to npm Ecosystem, Stealing Cloud and CI/CD Credentials From Developers
A credential-stealing malware campaign known as Shai-Hulud has expanded to target developers using the Leo/RStreams npm package ecosystem, harvesting GitHub tokens, cloud access keys, CI/CD secrets, and SSH...
Critical npm Supply Chain Attack: Malicious ‘dbmux’ Package Gives Hackers Full System Control
A malicious npm package named dbmux was discovered containing malware that gives attackers complete control over any developer system that installed it. Part of a coordinated wave of...
Massive Supply Chain Attack: Poisoned VS Code Extension and “Megalodon” Campaign Steal Credentials from Millions of Developers
Two coordinated supply chain attacks poisoned the Nx Console VS Code extension (2.2M installs) and backdoored 5,561 GitHub repositories simultaneously, stealing cloud credentials and 3,800 internal GitHub source...