#Developer Security
All CosmicBytez Labs articles tagged #Developer Security, across news, security advisories, how-to guides, and projects.
- News
Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Cybersecurity researchers have uncovered malicious Visual Studio Code extensions posing as Solidity development tools that silently exfiltrate crypto...
- News
Massive ChainDrop npm Supply Chain Attack Infects Hundreds of Packages
The ChainDrop worm — a larger descendant of the earlier Shai-Hulud attack — has compromised over 1,300 npm packages with a combined 2 billion monthly...
- News
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Developer Tool Users
Cybersecurity researchers discovered 18 malicious npm packages targeting Alibaba developer tools with a cross-platform RAT in a sophisticated supply chain...
- News
FakeGit Campaign Uses 7,600 GitHub Repos to Push SmartLoader Malware
A large-scale malware distribution operation called FakeGit has seeded 7,600 malicious GitHub repositories that collectively amassed over 14 million...
- News
SleeperGem: Three Malicious RubyGems Packages Target Developer Machines
Cybersecurity researchers have uncovered a new supply chain attack called SleeperGem, in which three trojanized RubyGems packages masquerade as legitimate...
- News
2-Click Cursor Exploit Enables Dev Environment Takeover
DeepJack: two clicks in Cursor IDE silently installs a malicious MCP server with full user privileges, stealing source code and secrets. Unpatched in July 2026.
- News
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
A design flaw in the Cursor AI code editor on Windows executes any file named git.exe found in the root of a cloned project directory — automatically,...
- News
Ghost Accounts Abuse GitHub API in Mass Recon Campaign
Multiple threat campaigns are leveraging disposable 'ghost' GitHub accounts to conduct mass reconnaissance against organizations, systematically mapping...
- News
'Ghostcommit' Hides Prompt Injection in Images to Fool AI Agents and Steal Secrets
Security researchers have demonstrated 'Ghostcommit,' a technique that embeds prompt injection payloads inside PNG images to bypass AI code review tools...
- News
Clean GitHub Repo Tricks AI Coding Agents Into Running Malware
Researchers demonstrate how a seemingly clean, scanner-safe GitHub repository can silently execute a malicious payload when an AI coding agent clones and...
- News
NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks
NPM 12 will disable dependency install scripts by default, requiring explicit opt-in—a major shift targeting the supply chain attack vector exploited...
- News
IronWorm and New Miasma Worm Variant Hit npm in Coordinated Supply Chain Attacks
Two distinct malware campaigns have hit the npm ecosystem simultaneously — IronWorm deploys a Rust-based infostealer via 50+ poisoned packages, while a new…
- News
VS Code Zero-Day Lets Hackers Steal GitHub Tokens in One Click
A security researcher has released exploit code for a Visual Studio Code zero-day vulnerability that allows attackers to steal GitHub authentication tokens by…
- News
OpenAI Codex Authentication Tokens Stolen via codexui-android npm Supply Chain Attack
Cybersecurity researchers have uncovered a malicious npm package named codexui-android that targets developers using OpenAI Codex by masquerading as a…
- News
Developer Workstations Are Now Part of the Software Supply
Supply chain attackers are no longer just targeting repositories and CI/CD pipelines — they're going after the developer workstations that hold the keys...
- News
Shai-Hulud Worm Clones Spread After Code Release
The public release of the Shai-Hulud worm source code by TeamPCP has triggered a wave of copycat variants appearing across the npm ecosystem. Security...
- News
Popular node-ipc npm Package Compromised to Steal
Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication npm package, in a new...
- News
TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks
Supply chain threat actor TeamPCP has struck again, publishing a tampered version of the Checkmarx Jenkins AST plugin to the Jenkins Marketplace — just...
- News
How LiteLLM Turned Developer Machines Into Credential
The TeamPCP threat actor's March 2026 supply chain attack against LiteLLM exposed a dangerous blind spot: developer workstations running local AI agents...
- News
Axios NPM Package Breached in North Korean Supply Chain
A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored versions of the widely used...
- News
Attack on Axios Developer Tool Threatens Widespread
Security researchers at multiple firms are sounding alarms over a supply chain attack against Axios, an npm package with 100 million weekly downloads....
- News
Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account
Two newly published versions of the widely used Axios HTTP client library — v1.14.1 and v0.30.4 — were found to contain a malicious fake dependency that...
- News
GlassWorm ForceMemo: Stolen GitHub Tokens Used to Poison
The GlassWorm threat actor has launched a new sub-campaign called ForceMemo, using stolen GitHub tokens to silently force-push malware into hundreds of...
- News
GlassWorm Escalates: 72 Malicious Open VSX Extensions Use
The GlassWorm self-propagating worm campaign has compromised 72 Open VSX extensions using invisible Unicode Private Use Area characters and a Solana...
- Security
Critical CORS + Path Traversal in TinaCMS CLI Dev Server
A critical CVSS 9.6 vulnerability in TinaCMS prior to 2.1.8 combines a permissive CORS policy with a path traversal flaw, enabling a remote attacker to...
- News
Trojanized MCP Server Deploys StealC Infostealer Targeting
A SmartLoader campaign distributes a trojanized Model Context Protocol (MCP) server disguised as Oura Health's legitimate tool, deploying StealC...