Attackers infected all versions with the same credential-stealing malware that, on Wednesday, poisoned multiple npm packages ...

A threat group planted a malicious npm package in a crypto trading project through an AI-generated commit by Anthropic's ...

Malicious Lightning 2.6.2/2.6.3 released April 30 enable credential theft via hidden payload, leading to PyPI quarantine and ...