Do Son Urgent: Uninstall the EOL Spring CLI VS Code extension now. CVE-2026-22718 (CVSS 6.6) allows command injection and will not be patched.
developer security
North Korea's Lazarus Group is waging a covert cyberespionage campaign, poisoning 234+ open-source packages on npm/PyPI to steal secrets from CI/CD pipelines and developer environments.
A malicious PyPI package named 'solana-token' targeted Solana developers to steal code and secrets. Learn how it worked and how to stay safe.