Netcrook
#Developer Security
GlassWorm’s Shutdown Shows Why Developer Tools Are Now High-Value Targets
A coordinated disruption of GlassWorm-linked command-and-control infrastructure highlights how supply-chain malware can live closest to the people who build software, not just the systems that run it.
Search Results Became the Trap: Fake AI CLI Installers Turn Developer Curiosity Into Risk
Counterfeit installers posing as Gemini CLI and Claude Code show how search manipulation can become a delivery channel for malware, even when the underlying products are not the target.
When AI Writes Code, Secrets Become the Real Attack Surface
A new credential model for OpenAI Codex spotlights a bigger security shift: coding agents should borrow access for a task, not keep secrets in their memory.
When the Bot Opens the Pull Request, the Real Risk Moves to Governance
AI coding has shifted from helpful autocomplete to software agents that can plan, edit, test, and submit changes - and that turns code review into a security control, not a formality.
Por qué la revisión de código seguro se está convirtiendo en un control de primera línea para los desarrolladores modernos
Una lista de servicios de revisión de código seguro orientada a desarrolladores pone de relieve una verdad más amplia: las vulnerabilidades más difíciles suelen ser las que los escáneres no detectan.
Code Under Siege: How Fake NuGet Packages Are Robbing Developers Blind
A stealthy malware campaign is siphoning browser passwords, SSH keys, and crypto wallets from thousands of unsuspecting developers worldwide.
Impostor Package on npm Turns Routine Install into Developer Nightmare
A fake TanStack npm package used a hidden script to steal secrets from unsuspecting developers in under 30 minutes.
Silent Sabotage: How a Hidden Cursor AI Flaw Lets Attackers Hijack Developer Machines
A newly uncovered vulnerability in Cursor’s AI coding agent exposes developers to stealthy code execution attacks-no phishing required.
Secrets for Sale: How a Popular AI Library Turned Every Developer Laptop Into an Attacker’s Playground
A supply chain hack on LiteLLM exposed just how vulnerable developer machines are-turning their convenience into a goldmine for cybercriminals.
Secretos a la venta: cómo una popular biblioteca de IA convirtió cada portátil de desarrollador en el patio de juegos de un atacante
Un ataque a la cadena de suministro en LiteLLM expuso cuán vulnerables son las máquinas de los desarrolladores-convirtiendo su conveniencia en una mina de oro para los ciberdelincuentes.
Blockchain Backdoor: Malicious Windsurf IDE Extension Targets Developers in Sophisticated Data Heist
Cybercriminals deploy a deceptive Windsurf IDE extension, exploiting the Solana blockchain to stealthily harvest developer secrets.
AI Turned Against Developers: Malicious VS Code Extensions Hijack Local AI Assistants
Cybercriminals weaponize AI-powered exploits to silently steal credentials from developer environments through compromised VS Code tools.
Behind the Code: How Fake Next.js Projects Became the Latest Hacker Trap for Developers
A new wave of attacks uses seemingly harmless Next.js repositories to hijack developer systems and exfiltrate sensitive data.
Hacker Job Lures: Next.js Repositories Turned Into Developer Backdoors
Cybercriminals are planting malicious code in fake coding projects, tricking developers into opening the door to sophisticated, hard-to-detect attacks.
Trusted Dev Tools Turned Against Coders: GlassWorm’s Stealthy Supply Chain Strike Exposes 22,000+ Developers
A brazen attack on the Open VSX Registry reveals how stolen publisher credentials transformed legitimate VS Code extensions into malware delivery vehicles, endangering thousands of unsuspecting developers.
Herramientas de desarrollo confiables se vuelven contra los programadores: el sigiloso ataque a la cadena de suministro de GlassWorm expone a más de 22,000 desarrolladores
Un audaz ataque al Open VSX Registry revela cómo credenciales robadas de un publicador transformaron extensiones legítimas de VS Code en vehículos de distribución de malware, poniendo en peligro a miles de desarrolladores desprevenidos.