The Hacker News

North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.
eWeek

Clean GitHub Repo Attack Exposes AI Coding Agent Risk

Mozilla 0DIN’s Claude Code demo shows how clean GitHub repos can expose AI coding agents to prompt injection, reverse shells, ...
InfoQ

AWS Introduces Workload Credentials Provider for Automated Certificate and Secret Management

AWS has recently announced the AWS Workload Credentials Provider to automatically deliver and refresh certificates and ...
SecurityWeek

Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks

Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, creating a new software supply ...
SecurityWeek

Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines

Attackers can inject indirect prompts in normal-looking repositories to trick Claude Code into spawning a reverse shell.

Clean GitHub repo tricks AI coding agents into running malware

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...
Reuters

Shell PLC

US LNG exports to Europe decline as Asia prices surge For the first time in nearly two years, less than half of U.S. LNG ‌exports last month went to Europe as stronger prices in Asia and record ...