Trivy vulnerability scanner breach pushed infostealer via GitHub Actions

The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed ...

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, ...

Ultralytics Debuts Ultralytics Platform: The Definitive Way to Annotate, Train, and Deploy ...

With 125,000 GitHub stars, 225 million package downloads, and 2.5 billion daily inferences, the team behind Ultralytics YOLO ...
InfoWorld

I ran Qwen3.5 locally instead of Claude Code. Here’s what happened.

You can now run LLMs for software development on consumer-grade PCs. But we’re still a ways off from having Claude at home.
Hackaday

This Week In Security: Linux Flaws, Python Ownage, And A Botnet Shutdown

Qualys reports the discovery by their threat research unit of vulnerabilities in the Linux AppArmor system used by SUSE, Debian, Ubuntu, and ...

"CanisterWorm" supply chain malware attacks npm

A threat actor who stole credentials from a legitimate node package manager (npm) publisher has spread a persistent, ...

AIエージェントをアプリに組み込む「GitHub Copilot SDK」

GitHubは3月10日(米国時間)、独自アプリケーションにCopilot型のAIエージェント機能を組み込める開発キット「GitHub Copilot ...
Security Boulevard

CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive

UTC, Aikido Security detected an unusual pattern across the npm registry: dozens of packages from multiple organizations were ...

Deep learning model predicts how individual cells influence disease outcomes

A computational method called scSurv, developed by researchers at Institute of Science Tokyo, links individual cells to ...
CSO Online

Trivy vulnerability scanner backdoored with credential stealer in supply chain attack

If you suspect you were running a compromised version, treat all pipeline secrets as compromised and rotate immediately,’ ...

OpenAI、Astralを買収 Python開発支援ツール「Ruff」「uv」を「Codex」へ統合

OpenAIは、Python開発者向け高速ツールを提供するAstralを買収することで合意した。高性能なコードチェックツール「Ruff」やパッケージ管理ツール「uv」を持つ同社の技術を、プログラミング支援AI「Codex」に統合する。開発ワークフロー ...
ビジネス+IT

OpenAIがPython開発ツールのAstralを買収、Codexに統合

米OpenAIは、Python開発者向けの高速なツール群を提供する米Astralを買収することで合意したと発表した。Astralが開発する「Ruff」や「uv」などのツールと技術陣を自社のプログラミング支援AI「Codex」の開発チームに統合し、コード生成にとどまらない自律的なソフトウェア開発エージェントの構築を加速させる狙いがある。Astralのツール群はオープンソースとして今後も提供が継続され ...