Nx Console Supply Chain Attack: What Developers Must Do Now
Nx Console v18.95.0 shipped a credential stealer that hit 6,000 developers and 3,800 GitHub repos. Rotate credentials now — here is the checklist.
SQLite Durable Workflows: Skip Temporal Until You Need It
An Obelisk team post just hit HN #2 with 472 points: SQLite is all you ...
Docker Gordon Is GA: AI Agent for Your Containers
Docker Gordon hit GA in Desktop 4.74 with persistent memory. Here's what changed, how it ...
WebAssembly 3.0: WasmGC, Memory64, and What Ships Now
WebAssembly 3.0 is W3C-standard. WasmGC works in all browsers. Memory64 is server-side ready. Here is ...
@supabase/server: Auth That Runs Before Your Code Does
Supabase's new @supabase/server SDK handles JWT validation, RLS-scoped clients, and auth boilerplate before your Edge ...
OpenAI Secure MCP Tunnel: Private MCP Servers, No Firewall Changes
OpenAI shipped Secure MCP Tunnel on May 27, 2026. Connect private MCP servers to ChatGPT, Codex, and the Responses API through outbound-only HTTPS. ...
GlassWorm Botnet Taken Down: Audit Your Developer Environment Now
CrowdStrike and Google took down the GlassWorm botnet on May 26. Your machine may still ...
Kyverno 1.18: SSRF Patches, CEL Push, ClusterPolicy Out
Kyverno 1.18 patches two SSRF CVEs, adds CEL gzip library, and advances the ClusterPolicy deprecation. ...
npm Staged Publishing: The 2FA Gate the TanStack Attack Made Necessary
npm 11.15.0 ships staged publishing with a mandatory 2FA approval gate — the defense designed ...
TrapDoor: The Supply Chain Attack That Hijacks Your AI
TrapDoor planted 34 malicious packages across npm, PyPI, and Crates.io — then used zero-width Unicode ...