Package Managers

Feeds to Scour
SubscribedAll
Scoured 220 posts in 17.4 ms

npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders

聽馃敆Dependency Resolution 聽Content type: Blog
socket.dev路

shcherbak-ai/licenseal: Fast cross-ecosystem dependency license compatibility checker + Claude Code review skill

聽馃敆Dependency Resolution 聽Content type: Code
github.com路路Hacker News

Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting

聽馃尶git 聽Content type: Blog
about.gitlab.com路

Upcoming breaking changes for npm v12 - GitHub Changelog

聽馃敆Dependency Resolution 聽Content type: Blog 聽Content type: Tutorial
github.blog路路Lobsters, Hacker News, r/javascript, r/node

someone actually leaked the Miasma supply chain attack toolkit source code on github

聽馃敆Dependency Resolution
safedep.io路路Hacker News, r/programming

GitHub pulls pin on npm's auto-run scripts

聽馃敆Dependency Resolution 聽Content type: News
theregister.com路

A package manager for AI assets (and why the lock file is per-user)

聽馃敆Dependency Resolution 聽Content type: Blog
sleuth-io.github.io路路Hacker News

New IronWorm malware hits 36 packages in npm supply-chain attack

聽馃敆Dependency Resolution
bleepingcomputer.com路路Hacker News

debsecan-mcp v0.1.2 released to PyPI

聽馃敆Topological Sorting 聽Content type: Blog
copyninja.in路

NASA Says Goodbye to Its Longtime Mars MAVEN Mission - Slashdot

聽馃敆Dependency Resolution
science.slashdot.org路

Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels

聽馃敆Supply Chain 聽Content type: Blog
socket.dev路路Hacker News

A popular OpenAI Codex tool with 29,000 weekly downloads has been quietly stealing developer tokens for a month

聽馃敆Dependency Resolution
thenextweb.com路

Config Files That Run Code: Supply Chain Security Blindspot

聽馃敆Dependency Resolution
safedep.io路路Hacker News

How 56 npm packages used binding.gyp to steal CI/CD secrets

聽馃敆Dependency Resolution 聽Content type: Blog
reversinglabs.com路

NASA's Mars MAVEN probe is dead

聽馃敆Dependency Resolution
engadget.com路路r/space

Glone: A CLI to back up all your GitHub repositories

聽馃敁Open Source Software 聽Content type: Code
github.com路路Hacker News

Miasma NPM Supply Chain Attack: Self-Spreading Worm via Phantom Gyp

聽馃敆Dependency Resolution 聽Content type: Blog
stepsecurity.io路路Hacker News

NPM-Scan v1.1.0: Four New Detectors for June 2026 Supply Chain Attacks

聽馃敆Dependency Resolution 聽Content type: Code
github.com路路Hacker News

Ongoing NPM supply chain attack uses binding.gyp to spread like a worm

聽馃敆Dependency Resolution 聽Content type: Code
github.com路路Hacker News

New IronWorm Malware Hits 36 Packages In npm Supply-Chain Attack

聽馃敆Dependency Resolution
it.slashdot.org路

No more posts from matmat's subscribed feeds.

Scour all 25255 feedsLearn more about Feeds

Keyboard Shortcuts

Navigation

Next / previous item
j/k
Open post
oorEnter
Preview post
v

Post Actions

Love post
a
Like post
l
Dislike post
d
Undo reaction
u
Save / unsave
s

Recommendations

Add interest / feed
Enter
Not interested
x

Go to

Home
gh
Interests
gi
Feeds
gf
Likes
gl
History
gy
Changelog
gc
Settings
gs
Browse
gb
Search
/

General

Show this help
?
Submit feedback
!
Close modal / unfocus
Esc

Press ? anytime to show this help