The Hacker News

TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO

TrapDoor spread 34 malicious packages across npm, PyPI, and Crates.io, stealing developer credentials and enabling persistence.
WGAL

IRS scam calls use AI to deceive consumers | Identify the red flags

ROCHE SHOWS US HOW WHENEVER WE CAN. FOLKS, THE EIGHT ON YOUR SIDE TEAM WANTS YOU TO SEE OR HEAR A SCAM IN ACTION SO YOU CAN RECOGNIZE IT. SO RIGHT NOW, LISTEN TO THIS VOICEMAIL SENT TO ME BY A VIEWER.
CSO Online

Unpatched ChromaDB flaw leaves servers open to remote code execution

The ChromaToast vulnerability can be exploited by forcing the ChromaDB API server to fetch and load maliciously crafted AI ...
CIO

Your Claude API bill is higher than your revenue: Why simple Python tasks are blowing up AI costs

Using top-tier AI for simple tasks is draining corporate budgets. If you don't match the tool to the job, your most popular ...

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed attackers stole 3,800 internal repositories via a poisoned VS Code extension. The same threat group, TeamPCP ...