#Packages

Compare five SCA tools for detecting malicious open-source packages, from behavioral analysis and install-time blocking to threat intelligence.

Meet AMPH - Arch Meta Package Harmonizer 🐧 A Rust-powered TUI to explore package dependencies,...

Imagine waking up to an urgent alert from your team: your web app is sending customer session tokens to an unknown server. You check your…

When the Flutter team announced they were discontinuing six first-party packages (flutter_markdown,...

I recently worked on a project where a Node.js application used Vite to compile its frontend. It worked in a browser-hosted development environment, but its image build failed after the move to Azure

Kubernetes manages what runs on your nodes. Managing the nodes themselves is the challenge: kernel settings, system packages, storage layouts, security agents…

v0 can now install private packages from npm and custom registries. Add an NPM_TOKEN or NPM_RC environment variable to build with your team's internal packages, design systems, and component libraries in v0.

Built a CLI tool that runs on Termux but can't get into termux-packages or TUR? Here are all your options for distributing it to Termux users: official repo, TUR, your own APT repo, and Termux App Store.

OpenAI agents carried out an undisclosed attack on RubyGems is a new bombshell report from Spencer Kitts, Thomas Larsen, and Sydney Von Arx—three of the four authors of the report …

Clojure interpreter hosted on Go, with extensible interop support. - glojurelang/glojure

In May 2026, attackers compromised 42 TanStack packages by poisoning a GitHub Actions build cache...

Michał Górny challenges the stereotype that Gentoo Linux exists only for performance chasing through compilation. The distribution delivers independence from corporate control, strong security practices, surprising stability in a rolling model, and…

Open-source supply-chain trust gate for MCP servers, validated on 200 packages. 3 BLOCK findings including 1 hardcoded LLM API key. 6 'official' servers abandoned. Free public API.

A malicious npm package called ua-parser-js2 impersonated the legitimate ua-parser-js library to steal sensitive files, environment variables, SSH keys, and credentials from developer machines via a post-install script.…

Recent attacks compromised laravel-lang packages and eight others via stolen GitHub credentials and hidden malware in package.json. Packagist's transparency log, Aikido detection, and upcoming immutable versions in Composer 2.10 mark concrete progress…

Most teams find out their dependencies are risky after something breaks. A maintainer disappears, a...