You're Invited: Delivering malware via Google Calendar invites and PUAs

Michael Bargury on Twitter / X

we hijacked perplexity comet by sending a weaponized calendar invitethen used it to takeover victim's 1p account and exfil their local filescall it pleasefix. like clickfix, but instead of social eng'ing a human you just ask their ai real nicelyincredible work by @StAJect0r pic.twitter.com/oMCswqcMZj— Michael Bargury (@mbrg0) March 3, 2026

Keyv and friends compromised in npm supply chain attack

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account

This ‘Privacy Browser’ Has Dangerous Hidden Features

The Universe Browser is believed to have been downloaded millions of times. But researchers say it behaves like malware and has links to Asia’s booming cybercrime and illegal gambling networks.

Unverified apps - Google Cloud Platform Console Help

An unverified app is an app or Apps Script that requests a sensitive or restricted OAuth scope, but hasn't gone through the Google verification process. Users of unverified apps or your test builds mi

Unverified apps - Google Cloud Platform Console Help

An unverified app is an app or Apps Script that requests a sensitive or restricted OAuth scope, but hasn't gone through the Google verification process. Users of unverified apps or your test builds mi

Incident Report: Leaked GitHub Personal Access Token - The Python Package Index Blog

We responded to an incident related to a leaked GitHub Personal Access Token for a PyPI administrator.

Glassworm Returns: Invisible Unicode Malware Found in 150+ GitHub Repositories

The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.

GitHub - ThisIsMissEm/questionable-fyi: Questionable is an AT Protocol app for asking questions and getting answers, receiving asks and doing interviews or AMAs

Questionable is an AT Protocol app for asking questions and getting answers, receiving asks and doing interviews or AMAs - ThisIsMissEm/questionable-fyi

npm Worm Poisons keyv, cacheable and 400+ Other Packages Across Twelve Organisations

A worm moved one byte-identical credential stealer through more than 400 npm packages in twelve organisations on 4 August 2026, including @ornikar, @deliveroo, @servicetitan, @qlik, Picsart and the keyv and cacheable family. latest still resolves to a poisoned version on most affected names, and the payload installs a dead-man switch that fires when the stolen GitHub token is revoked, so rotating credentials first triggers it.

Dialog Claims It Was Hacked. A Misconfigured Website Left Its Members Exposed

The private events group, cofounded by Peter Thiel, says a “criminal” hacker is behind a breach that exposed members’ personal details. WIRED found no evidence a break-in was needed to access the files.

Comment and Control: Prompt Injection to Credential Theft in Claude Code, Gemini CLI, and GitHub Copilot Agent

Anthropic Claude Code Security Review, Google Gemini CLI Action, and GitHub Copilot Agent are vulnerable to prompt injection via GitHub comments — turning PR titles, issue bodies, and issue comments into attack vectors for API key and token theft.

Download pumping: New npm deception technique for supply chain attacks

Learn how attackers exploit automated bot traffic as part of software supply chain attacks to artificially inflate download counters and mask malicious payloads as legitimate.

Popular npm Packages in the keyv and Cacheable Namespaces Co...

Popular npm packages keyv and cacheable compromised.