GitHub confirmed attackers stole 3,800 internal repositories via a poisoned VS Code extension. The same threat group, TeamPCP ...

Vercel Labs released Zero on May 15, 2026 — a low-level systems programming language whose compiler was built from the ground ...

The ChromaToast vulnerability can be exploited by forcing the ChromaDB API server to fetch and load maliciously crafted AI ...

The world’s largest open-source registry, node package manager (npm), has been hit by another fast-moving malware attack, ...

Fox Tempest is a financially motivated threat actor operating a malware‑signing‑as‑a‑service (MSaaS) used by other ...

Stolen credentials produced valid Sigstore certificates, clearing 633 malicious npm packages — one of seven developer tool ...

Nathan is a tech journalist from Canada who spends too much money on gadgets. You can find his work on Android Police, Digital Trends, iMore, Mobile Syrup and ZDNET. Nathan studied journalism at ...

说白了，今天 Skills 生态的状态跟三年前 npm 生态的状态很像——什么都有，但大多数你不需要，少数几个能真正改变你的工作流。判断标准不是 star 数，是它有没有在教 Claude 你独特的工作上下文。把这个逻辑想清楚，1400+ 这个数字就不再让人焦虑了。 三个月前 ...