A poisoned npm package infected 140+ projects with a hidden payload. This report highlights how to detect, hunt, and defend ...

Here's how to torrent safely and download any file you want anonymously. These are the 5 best practices for safe torrenting ...

A flaw in Hugging Face Transformers could allow malicious AI models to execute code, exposing credentials and highlighting AI supply chain risks.

With over 2.2 billion installs, the flawed Python package offers attackers a huge blast radius, including silent access to high-value enterprise users running GPU-accelerated inference. A high ...

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and ...

The repository reached the #1 trending position on Hugging Face within 18 hours, highlighting how public AI repositories are becoming a new software supply chain attack vector. A malicious Hugging ...

A malicious Hugging Face repository that reached the platform’s trending list impersonated OpenAI’s “Privacy Filter” project to deliver information-stealing ...

Users noticed Google Chrome silently downloading a 4GB file called “weights.bin” in the background, sparking privacy concerns. This file actually helps run Gemini Nano on-device, improving privacy by ...

The move lets IT administrators standardize and distribute agent behaviors across engineering teams, but OpenAI’s third-party marketplace is not yet open. OpenAI has introduced a plugin system for ...

This project is now archived. It has been succedded by Hitrava which performs the same job but better. N.B. Huawei have caught onto us, and you now need a rooted phone to be able to use this method.

The North Korean threat actors behind the Contagious Interview campaign have once again tweaked their tactics by using JSON storage services to stage malicious payloads. "The threat actors have ...