Claude Code with Opus 5.5 finishes coding tasks in a median of 2.2 minutes for $116 in total, the fastest run on our board and the cheapest Anthropic run by far, but lands at only 33.5% for secure cod...

A compromised release of @7nohe/openapi-react-query-codegen runs a dropper on install through three separate triggers, then harvests cloud credentials and republishes itself across npm, RubyGems, and ...

Hacking your life with AI can get you hacked

Five official @asyncapi npm packages shipped malware through legitimate GitHub Actions publish pipelines

Claude Fable 5, take two: same model, different harness, and a very different result

A single hijacked maintainer account pushed multiple trojanized packages across the entire @mastra scope in 27 minutes, each carrying a typosquat dependency that runs a remote payload on install. Comb...

We benchmarked Claude Fable 5 on 200 real-world coding tasks for the Agent Security League.

Endor Labs detected a potentially malicious versions of ai-sdk-ollama, a popular Ollama SDK on npm with 120K+ monthly downloads. Here's what we know and what to do now.

Malicious PyPI package durabletask 1.4.1-1.4.3 steals AWS, Azure, and GCP credentials on import. 417k monthly downloads affected.

Endor Labs and Chainguard partner to deliver end-to-end software supply chain security to eliminate vulnerabilities at source and surface what's exploitable in a single integrated workflow.

Endor Labs detected 42 malicious npm packages forging valid Sigstore provenance. If you installed affected packages May 19, rotate all credentials now.

OpenAI's newest model now holds the top security score on the Agent Security League through Cursor as the agent harness. Through Codex, it ties for third on security but trails on functional correctne...

An attacker took over the npm account behind react-native-international-phone-number and react-native-country-select, publishing three waves of malicious versions containing malware linked to the Glas...

Endor Labs security researchers identified 88 malicious open source packages belonging to three new waves of the PhantomRaven campaign.

CVE-2026-25896 allows XSS and injection attacks by shadowing XML built-in entities in fast-xml-parser via regex wildcard in entity name

101 packages disguised as font files distributed 34 TiB of data via npm's infrastructure—with a total of 4.3 PiB transferred via downloads.

Secure copilot for coding assistants. Contribute to endorlabs/gemini-extension development by creating an account on GitHub.

CVE-2025-13780 is a critical vulnerability in pgAdmin 4 where whitespace characters bypass regex filters, a common failure mode in input validation.

Treating a security patch as a signal, not a conclusion, led us to discover how arbitrary file writes became remote code execution in Argo Workflows.

Analysis of Shai-Hulud 2, a new npm supply chain attack using Bun for execution, credential theft, and CI/CD propagation, with mitigation guidance.