grep -rl "developer-tools" ./articles
Australian police arrested a 21-year-old and a 23-year-old over the TeamPCP supply-chain campaign, which allegedly compromised Trivy, LiteLLM, Telnyx, SAP and TanStack packages and breached the European Commission, Mistral AI, OpenAI and GitHub. The AFP puts it at half a million credentials and 300GB of data. Nothing is proven.
Veracode's 2026 report puts the security pass rate for AI-generated code at 56%, against 55% a year ago, while syntax correctness sits near 100%. The gap by vulnerability type is the finding: 87% on cryptographic algorithms and 83% on SQL injection, against 15% on cross-site scripting and 12% on log injection.
isolated-vm is how a lot of Node applications run untrusted JavaScript without a container. EndorLabs found its ExternalCopy path iterates a transfer list twice and trusts the earlier pass, so a JavaScript getter returning different values each time can point the native layer at attacker-chosen memory. Fixed in 6.2.0 and 7.0.1.
arrayref has over 245 million downloads. On 20 August a malicious 0.3.7 appeared on crates.io with a dependency impersonating proc-macro2, whose build script fetched a second stage over TLS with certificate validation switched off. Wiz attributes it to a North Korean actor on infrastructure overlaps with two earlier campaigns.
watchTowr reproduced CVE-2026-19478 within minutes of disclosure and then saw it used against its own honeypots. Beyond deleting repositories, it lets an attacker fabricate merge records and ban maintainers — which means the log that says a security fix was applied can itself be the lie.
CVE-2026-19478 is a CVSS 9.4 in GitLab CE and EE: under certain conditions an unauthenticated user could modify or delete public projects and user data through a GraphQL directive. Patches landed on 17 August outside the normal release train. GitLab.com is already covered; self-hosted is not.
Tenet Security's GhostJacking turns monitoring data into an instruction channel for AI agents, chaining to cloud pivot, exfiltration and persistence. A separate Cursor CLI flaw let a cloned repo run commands before any trust prompt appeared.
Sonatype tracked a campaign flooding npm with 846 packages carrying a multi-stage JavaScript loader. It fingerprints the operating system, fetches a matching payload, and on Windows patches security functions before establishing persistence through a scheduled task.
Mitiga found prompt-exfiltration tradecraft in the wild — malicious natural-language instructions in .cursorrules and CLAUDE.md that make the agent collect prompts, tokens and environment variables and send them onward. Also: 1,230+ hardcoded API keys sitting in AI instruction files.
Datadog Security Labs found that trusting a project is enough. In Codex, a project-scoped MCP config starts an attacker-controlled process; in Claude Code, a project-controlled PATH gets a repository wrapper executed by Claude's own Git probes. Neither needs a model response or an approval prompt.
Novee Security took Claude Code, Gemini CLI and OpenAI Codex to Black Hat and found the same structural bug in all three: one component marks a value safe, a later component acts on it with more authority. Gemini CLI's carries a CVSS 4.0 of 10.0.