#Open Source Security
All CosmicBytez Labs articles tagged #Open Source Security, across news, security advisories, how-to guides, and projects.
- News
Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
Anthropic's free, opt-in OSS Scanner uses Claude Mythos to audit open-source projects, surfacing 29,000+ candidate bugs and 584 advisories so far.
- News
Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund
Anthropic upgrades Claude Security to Mythos 5 for enterprise defenders and launches the $35M Defender Advantage Fund for open source vulnerability patching.
- News
NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Cycode found chained flaws in NASA's open-source AMMOS Instrument Toolkit GUI allowing unauthenticated attackers to send arbitrary spacecraft commands.
- News
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
A compromised maintainer account pushed malicious versions of three popular Rust crates, injecting build-time malware affecting 245 million downloads.
- News
Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself
During UK AI Security Institute cyber evaluations, an agent running Anthropic's Claude Mythos 5 autonomously spent 34 hours attempting to inject a malware...
- News
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Developer Tool Users
Cybersecurity researchers discovered 18 malicious npm packages targeting Alibaba developer tools with a cross-platform RAT in a sophisticated supply chain...
- News
GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI have introduced time-based mechanisms in the Dependabot dependency management tool to protect against supply-chain attacks, limiting the...
- News
SleeperGem: Three Malicious RubyGems Packages Target Developer Machines
Cybersecurity researchers have uncovered a new supply chain attack called SleeperGem, in which three trojanized RubyGems packages masquerade as legitimate...
- News
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
The popular jscrambler npm package was hijacked in version 8.14.0, silently dropping and executing a cross-platform Rust-based infostealer via a malicious...
- News
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
The Miasma supply chain malware family — an evolution of Mini Shai-Hulud and linked to the Hades worm — has compromised hundreds of npm packages, abused...
- News
OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security Flaws
OpenAI has released GPT-5.5-Cyber, its most capable security model yet, as part of the Daybreak initiative — targeting real-world vulnerabilities in...
- News
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
GitHub has announced that npm version 12 will disable install scripts by default as a breaking change aimed at combating software supply chain attacks...
- News
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft
A new supply chain attack campaign dubbed BufferZoneCorp has been observed using sleeper packages in RubyGems and Go module registries to push...
- News
PyTorch Lightning and Intercom-client Hit in Supply Chain
Threat actors compromised the popular Python PyPI package 'Lightning' — used for PyTorch model training — pushing malicious versions 2.6.2 and onward to...
- News
13-Year-Old Bug in ActiveMQ Lets Hackers Remotely Execute
Security researchers discovered a remote code execution vulnerability in Apache ActiveMQ Classic that went undetected for 13 years, allowing attackers to...
- News
Axios npm Hack Used Fake Teams Error Fix to Hijack
The Axios HTTP client post-mortem reveals North Korean threat actors used a ClickFix-style fake Microsoft Teams error message to socially engineer a...
- News
The State of Trusted Open Source Report: Key Findings for 2025
Chainguard's first-ever State of Trusted Open Source report reveals critical insights into open source consumption patterns across container images,...