Dependency Confusion

Feeds to Scour
SubscribedAll
Scoured 228 posts in 39.9 ms
🔗Supply Chain AttacksDEV Community·

144 Mastra npm packages compromised in software supply chain attack

Discussed on DEV
Feeds
Less-relevant results
🤖Multi-Agent Systemsthreat-intelligence.redeyesecurity.com·

AutoJack: One Web Page Turns a Local AI Agent Into Host Code Execution

Discussed on DEV
Feeds
⌨️CLI Toolsrmux.io·

The Multiplexer Engine for Agents

Feeds
🔧MCPstepsecurity.io·

Mastra NPM Supply Chain Attack: 140 Packages Backdoor via easy-day-JS Typosquat

Covered by 5 sources See all sources covering this story including thehackernews.com, Malware Analysis, News and Indicators
Discussed on Hacker News
Feeds
⚡SupabaseGitHub·

AI Can Build the Prototype. Production Is Still the Hard Part.

Discussed on DEV
Feeds
📦Package Managersmicrosoft.com·

From package to postinstall payload: Inside the Mastra npm supply chain compromise

Covered by 4 sources See all sources covering this story including BleepingComputer, Malware Analysis, News and Indicators
Feeds
🔐Supply Chain Securitydoi.org·

Beyond SLSA: How to Stop Zero-Click CI/CD Worms with a 9-Step Plan

Discussed on DEV
Feeds
🔒SecurityDEV Community·

North Korean Hackers Poisoned 140+ npm Packages in an AI Dev Tooling Attack. Here's What Would Have Caught It.

Discussed on DEV
Feeds
🐙GitHubsocradar.io·

May 2026: TeamPCP’s Supply Chain Blitz Hits Checkmarx, GitHub, and npm

Covers Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft
Feeds
🐙GitHubLWN.net featured content·

Eliminating long-lived credentials with trusted publishing

Covers OSS North America
Feeds
🗄️Databasesnpmjs.com·

A Quick Setup for NestJS 11 + Prisma 7 + PostgreSQL backend in seconds.

Discussed on DEV
Feeds
🐧LinuxMalware Analysis, News and Indicators·

Supply Chain Attack Compromising Arch Linux AUR Packages with Infostealer and Rootkit

Feeds
📦Package Managersdevblogs.microsoft.com·

Announcing TypeScript 7.0 RC

Covered by heise online, sergeytihon.com
Discussed on r/javascript
Feeds
🔒Information Securityrisky.biz·

Risky Business #842 -- Anthropic needs an adult in the C suite

Covers Anthropic suspends new AI models after government directive
Feeds
🔒Information Securitythehackernews.com·

ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories

Covers 9 stories See all stories this covers including Bod 26-04: Prioritizing Security Updates Based on Risk
Feeds
🔒Information SecurityThe New Stack·

52,000 packages passed every security check. Chainguard blocked them anyway.

Discussed on DEV
Feeds
🐙GitHubDEV Community·

One npm Account Publishes 964 Million Downloads Per Week. None Have Provenance.

Discussed on DEV
Feeds
🐙GitHubsigmon.dev·

The most-installed JS frameworks aren't the most-starred — I checked 14

Discussed on DEV
Feeds
🔧MCPsimonwillison.net·

Quoting Sean Lynch

Feeds
🐧Linuxnews.risky.biz·

Risky Bulletin: Arch Linux supply chain attack spreads to 1,900+ AUR packages

Covers 19 stories See all stories this covers including Statement on the US government directive to suspend access to Fable 5 and Mythos 5
Covered by lawfaremedia.org
Feeds

Keyboard Shortcuts

Navigation

Next / previous post
j/k
Open post
oorEnter
Preview post
v

Post Actions

Love post
a
Like post
l
Dislike post
d
Undo reaction
u
Save / unsave
s

Recommendations

Add interest / feed
Enter
Not interested
x

Go to

Home
gh
Interests
gi
Feeds
gf
Likes
gl
History
gy
Changelog
gc
Settings
gs
Discover
gb
Search
/

General

Show this help
?
Submit feedback
!
Close modal / unfocus
Esc

Press ? anytime to show this help