Newly discovered npm package 'fezbox' employs QR codes to hide a second-stage payload to steal cookies from a user's web browser. The package, masquerading as a utility library, leverages this innovative steganographic technique to harvest sensitive data, such as user credentials, from a compromised machine.| BleepingComputer
The largest supply-chain compromise in the history of the NPM ecosystem has impacted roughly 10% of all cloud environments, but attackers made little profit off it.| BleepingComputer
Updated 2025-09-25 to reflect: Postponement of Q&A Session and link to updated statement. Ruby Community, At the heart of Ruby Central’s mission is our responsibility to steward the open source tools that power the Ruby ecosystem. That commitment is only as strong as the people and processes behind| Ruby Central
GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.| The GitHub Blog
