grep -rl "open-source" ./articles
An MIT-licensed OSINT globe with 17.7k stars refuses to add person tracking and warns its own data may be wrong. A facial recognition product with the same name claims to unmask faces, detect sex changes and score attractiveness as trafficking risk, and publishes no accuracy figure at all. The name is identical. The honesty is not.
Australian police arrested a 21-year-old and a 23-year-old over the TeamPCP supply-chain campaign, which allegedly compromised Trivy, LiteLLM, Telnyx, SAP and TanStack packages and breached the European Commission, Mistral AI, OpenAI and GitHub. The AFP puts it at half a million credentials and 300GB of data. Nothing is proven.
Glassbox runs 30-plus fingerprinting techniques locally and tells you how identifiable you are. Its author measured Chrome at 99% and Tor Browser at 56%, and one work session as unique among 7.6 billion browsers. His advice is the opposite of what most privacy guides say: stop customising, and get into a large identical crowd.
Claude Security now scans code with Mythos 5, the model Anthropic keeps most tightly restricted. Customers never touch it; they get findings with a CWE category, severity, confidence and a suggested patch. Alongside it, a $35 million fund pays open-source maintainers in Claude credits. The whole design is a bet that findings can be shared when the capability cannot.
Shai-Hulud's second wave hit somewhere between 600 and 800 packages depending on who counted. The packages were pulled within days. The credentials it published to public GitHub repos are what produced breaches months later — including Suno's.
Unauthenticated SQL injection through the password-reset endpoint, every release from 1.58 onward affected, and confirmed victims already naming what was taken. It is tracked as a GitHub advisory, which means NVD-driven scanners will not see it.
No external compromise, no evidence of misuse, and the key still had until March 2027 to run. Mozilla revoked it anyway — which is the right call, and a useful reference point for how a signing-key incident should read.
Sonatype tracked a campaign flooding npm with 846 packages carrying a multi-stage JavaScript loader. It fingerprints the operating system, fetches a matching payload, and on Windows patches security functions before establishing persistence through a scheduled task.
CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments, and it was patched in July. Telemetry recorded 650 exploitation attempts from 244 IPs before CISA added it to the KEV catalog on 5 August.