The Hacker News

TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO

TrapDoor spread 34 malicious packages across npm, PyPI, and Crates.io, stealing developer credentials and enabling persistence.
MUO on MSN

I gave Claude, ChatGPT, and Gemini the same broken JavaScript to debug — only one found the actual cause

Debugging isn’t just guessing.
GitHub

async_javascript-d0586453-76ec-4ec9-9965-780af7cb31ec.yaml

The Async Javascript plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '&aj_gtmetrix_username=' and '&aj_gtmetrix_api_key=' parameters in versions up to, and including, 2.20.12 ...
GitHub

async-javascript-plugin-d41d8cd98f00b204e9800998ecf8427e.yaml

The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the aj_steps AJAX ...