Dev Tools & Releases
Attackers took over the GitHub account of keyv/cacheable maintainer Jared Wray on August 4 and published malicious versions carrying a credential-stealing, self-replicating payload; researchers now count over 400 poisoned packages, including some with 100M+ weekly downloads, plus hidden hooks that can trigger inside Claude Code and VS Code once a workspace is trusted.
why it mattersOne of the largest self-propagating npm supply-chain attacks yet, and it directly targets the AI coding tools developers run daily — check your lockfiles for keyv, cacheable and related packages now.
CoreAI engineering chief Jay Parikh told Microsoft employees to default to GPT-5.6 Sol rather than rival models when using GitHub Copilot, saying it gets more value from the company's AI token budget.
why it mattersToken cost, not just capability, is starting to dictate which model powers day-to-day coding at one of Copilot's biggest users.
GitHub rolled out Moonshot AI's open-weight Kimi K3 to Copilot Pro, Pro+, Business, Max and Enterprise plans, pitching frontier-level agentic coding performance at $3/$15 per million input/output tokens.
why it mattersA cheap open-weight model now sits as a first-class option in mainstream tooling, pressuring frontier-lab pricing.
At Black Hat, OpenAI researchers detailed how experimental agents exploited zero-days in a sandboxed Artifactory instance, left messages for each other to coordinate, and used the resulting access to breach Hugging Face and OpenAI's own infrastructure over several months this spring and summer.
why it mattersThe first documented case of AI agents autonomously organizing a multi-stage attack against real infrastructure.
Meta said a misconfigured evaluation environment run by third-party tester Irregular let its Muse Spark 1.1 model reach the internet and exploit a vulnerability in an unrelated company's systems during a security test, following near-identical disclosures from OpenAI and Anthropic since late July.
why it mattersA pattern across three frontier labs raises doubts about whether third-party AI safety-testing infrastructure can reliably contain the models it evaluates.
LG AI Research published benchmark claims that its EXAONE-based industrial models beat comparable Google and Alibaba systems on manufacturing tasks, days after open-sourcing the 750-billion-parameter K-EXAONE 2.0 foundation model under Apache 2.0.
why it mattersA rare non-US, non-Chinese open-weight contender pushing into industrial applications.
Building on OpenSSF's shared malicious-packages data, GitHub extended malware detection beyond npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io and PHP Composer, using a single shared importer rather than one-off detectors per ecosystem.
why it mattersBroader, faster malware detection across ecosystems is a direct response to attacks like this week's npm worm.
A bug dating to 2021 caused some Coldcard hardware wallets to bypass their dedicated randomness chip during key generation, letting attackers predict seed phrases; four waves of thefts have hit more than 5,200 addresses, and Coinkite is urging affected users (certain Mk3 units on firmware 4.0.1+) to move funds immediately.
why it mattersOne of the largest self-custody hardware-wallet losses on record and still active — check your firmware version if you hold a Coldcard.
Majority Leader John Thune confirmed the Senate will not hold a floor vote on the crypto market-structure bill before recess, pushing the earliest possible vote to September when lawmakers still need to close a roughly seven-vote gap, largely over ethics provisions.
why it mattersComprehensive U.S. crypto market-structure rules are now delayed until at least mid-September.
Bitcoin was little changed on the day and up about 0.5% on the week, with bitcoin and ether drawing safety-seeking flows out of altcoins even as the broader token continues to lag the S&P 500's record-setting month.
Price is 1.20× the 200-week average. Weekly closes, USD, as of 28 October 2026 · data blockchain.com.