Dev Tools & Releases
Attackers compromised the maintainer behind keyv (127M weekly downloads) and its sibling caching packages, pushing a preinstall script that harvests GitHub, npm, cloud, and private-key credentials across a family with billions of monthly installs. The poisoned releases carried valid GitHub OIDC and SLSA provenance, and the keyv repo itself contained Claude Code and VS Code hooks that could trigger the payload when a workspace was opened.
why it mattersValid provenance signing meant standard supply-chain defenses didn't catch it, and the AI-tool hooks show attackers are now specifically targeting coding-agent workflows.
The update shows how long each tool call is taking in real time, auto-updates first-party plugins at session start, and adds an experimental /new-worktree command that spins up a fresh git worktree and conversation in one step.
why it mattersSmall but practical workflow fixes for anyone running Copilot CLI day to day, including a login flow fix for IDE integrations.
Sinch's new Agent Tools bring its messaging, voice, and verification APIs into VS Code, JetBrains, GitHub Copilot, Claude Code, and Cursor, with a simulator mode that lets developers test integrations before creating an account.
why it mattersOne more sign that vendors are now shipping MCP servers as a default way to reach AI coding assistants, not an afterthought.
The 2.4-trillion-parameter model (95B active per request) posts a 93.0 on PaperBench, ahead of GPT-5.6 Sol and Fable 5 on that benchmark, though no independent evaluations existed as of release.
why it mattersAnother frontier-class open release from China landing within days of Alibaba's own Kimi K3 rival, underscoring how fast the gap to US labs is closing on paper.
Former California Supreme Court Justice Mariano-Florentino (Tino) Cuéllar, most recently president of the Carnegie Endowment, joins to lead policy and government relations after serving as a trustee of Anthropic's Long-Term Benefit Trust.
why it mattersComes as Anthropic works to smooth relations with the Trump administration after export-control fights over its models earlier this year.
GitHub Spark stops accepting new users and new apps as of August 4, with existing users able to export their apps through August 31. GitHub says builders have shifted to Copilot's agentic workflows in VS Code, the CLI, and the Copilot app instead.
why it mattersFollows GitHub Models' full retirement on July 30, consolidating GitHub's AI app-building story onto Copilot rather than standalone tools.
A 2021 firmware error routed seed generation on some Coldcard hardware wallets to a weak software PRNG instead of the hardware RNG, cutting effective entropy as low as 40 bits. Attackers have swept 1,800+ BTC from over 5,200 exposed addresses since July 30; Coinkite's CEO has urged all affected users to generate new seeds and move funds immediately.
why it mattersA hardware-wallet flaw hitting cold storage undercuts the core pitch of self-custody, and researchers say a fourth sweep is still in progress.
Strategy (formerly MicroStrategy) sold 1,638 BTC between July 27 and August 2 at an average price of $63,957, below its $75,419 acquisition cost, to fund dividends and buybacks on its STRC preferred stock. It's the company's third sale of 2026.
why it mattersThe largest corporate Bitcoin holder selling at a loss to cover preferred-stock obligations is a notable crack in the buy-and-hold treasury playbook.
The SEC has stayed its own approval of Nasdaq PHLX's cash-settled Bitcoin index options (QBTC) after CME Group argued Bitcoin derivatives belong under CFTC jurisdiction, not the SEC's. Public comments are due August 24, with no timetable set for a final decision.
why it mattersA jurisdictional turf fight between regulators could set precedent for who oversees Bitcoin derivatives products going forward.
Price is 1.20× the 200-week average. Weekly closes, USD, as of 28 October 2026 · data blockchain.com.