The risk in the JavaScript ecosystem isn't theoretical: earlier this month, a number of packages used by millions of developers were compromised via malicious code. These malware attacks against ...

The developer of a popular open-source tool added pro-Ukraine “protestware” to the software, prominent cybersecurity journalist Brian Krebs reported on Thursday. The open-source tool in question is ...

Google has expanded its OSS-Fuzz Reward Program to offer rewards of up to $30,000 for researchers who find security flaws in open-source programs. The expanded scope of the program now means the total ...

Merchants building businesses on giant marketplaces often have to think inside the marketplace’s box, but Medusa, a one-year-old e-commerce startup from Denmark, is going after e-commerce platforms, ...

There isn’t nearly enough money in open source today. We can complain about venture capitalists distorting open source licensing, wring our hands about sustainability, and fret over how much ...

Google has detailed some of the work done to find malicious code packages that have been sneaked into bigger open-source software projects. The Package Analysis Project is one of the software supply ...

With the open-sourcing of its Windows Library for JavaScript (WinJS) this week, Microsoft is looking to get the technology spread to multiple browsers and platforms beyond Windows — and that includes ...

Popular JavaScript libraries were hijacked this week and turned into malware droppers, in a supply chain attack achieved via targeted phishing and credential theft. The attacker(s) used stolen ...