Are agent skills safe to install? A 1.7M-install trojan
Trojanized skills hit 1.7M displayed installs before takedown. See how the attack worked, a 6-check audit script, and what it found on a real dev machine.
Wed Oct 28 2026 · 9 min read · 1 views
#supply chain security
How the keyv npm attack reached VS Code and Claude Code
On Tuesday morning a caching library most developers have never thought about became the fastest-moving malware delivery system on the internet. A poisoned release of keyv went up at 09:35 UTC. Within
Wed Aug 05 2026 · 5 min read · 15 views