# npm Published articles for npm. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting DevFeed: [PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting]() Original publisher: [Read original article]() Author: Maddie Stewart Published: 2026-09-16T13:36:43.658349Z Content type: news Language: en Sources: [Blog]() Topics: [Malware](), [Large Language Model](), [JavaScript](), [npm](), [npm packages](), [Bug Bounty]() Tags: [bug-bounty](), [javascript](), [llm](), [malware](), [npm](), [npm-packages](), [threat-hunting-intel]() ### AI overview CrowdStrike reports that a financially motivated bug bounty hunter developed and distributed PhantomRaven, a JavaScript-based information stealer through npm. The company assesses with high confidence that a large language model was used to write the malware and says the operator likely used it to identify bug bounty opportunities. ### Source excerpt CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven. ## How to Orchestrate Multi-Call Conversations with an LLM and Twilio Conversation in Node.js Memory DevFeed: [How to Orchestrate Multi-Call Conversations with an LLM and Twilio Conversation in Node.js Memory]() Original publisher: [Read original article]() Author: Amanda Lange, Dhruv Patel Published: 2026-09-14T00:00:00Z Content type: tutorial Language: en Sources: [Twilio Blog]() Topics: [Node.js](), [Large Language Model](), [Express](), [OpenAI](), [API](), [WebSocket](), [Machine learning]() Tags: [api](), [axios](), [console](), [developer-insights](), [environment-variables](), [express](), [how-to](), [http](), [ide](), [install](), [js](), [json](), [llm](), [ngrok](), [node-js](), [npm](), [openai](), [rest-api](), [sdk](), [visual-studio-code](), [web]() ### AI overview This tutorial shows how to build a Node.js Express service that uses Twilio Conversation Memory, OpenAI, and voice streams to preserve caller context, preferences, and action history across separate inbound calls. It covers project setup, package installation, local webhook exposure with ngrok, and access to Twilio's Conversation Memory REST API. ### Source excerpt Learn how to orchestrate multi-call voice conversations using Node.js, OpenAI, and Twilio Conversation Memory to persist caller context across separate calls. ## Make Outbound Calls with Twilio Voice and Media Streams, GPT-Live-1 in the OpenAI API, and Node.js DevFeed: [Make Outbound Calls with Twilio Voice and Media Streams, GPT-Live-1 in the OpenAI API, and Node.js]() Original publisher: [Read original article]() Author: Paul Kamp Published: 2026-09-10T00:00:00Z Content type: tutorial Language: en Sources: [Twilio Blog]() Topics: [AI Agent](), [Tutorial](), [API](), [Node.js]() Tags: [agent](), [ai-agent](), [api](), [developer-insights](), [ngrok](), [node-js](), [npm](), [server](), [tutorial]() ### AI overview A tutorial for building an AI voice agent that places outbound calls using Twilio Programmable Voice and Media Streams, OpenAI's GPT-Live-1 API, and Node.js. The agent can explain the call, retrieve a callback note, and search the web when needed. ### Source excerpt Build an AI agent that places outbound calls with Twilio Programmable Voice and Media Streams, powered by OpenAI's GPT-Live-1. ## MAST in the Age of Open Source Software |Guardsquare DevFeed: [MAST in the Age of Open Source Software |Guardsquare]() Original publisher: [Read original article]() Author: Simon Haven - Product Marketing Manager Published: 2026-09-01T10:59:01Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Open Source](), [Mobile Security](), [Application Security](), [Vulnerabilities](), [Social engineering](), [npm]() Tags: [app-security-testing](), [application-security](), [appsweep](), [general](), [malware](), [mobile](), [mobile-apps](), [npm](), [open-source](), [open-source-software](), [social-engineering](), [supply-chain](), [vulnerabilities]() ### AI overview This article explains why mobile application security testing is important when apps use free and open source software. It describes how vulnerable, deprecated, compromised, and transitive third-party dependencies can expand an app's attack surface, citing a September 2025 npm supply chain attack as an example. ### Source excerpt Building with free and open source software (FOSS) has become common practice for app developers. In 2022, it was estimated that between 70% and 90% of any given software codebase was made up of open source components. Leveraging open source projects presents many advantages: ## How to Use Svelte and Go to Build a Video Chat App DevFeed: [How to Use Svelte and Go to Build a Video Chat App]() Original publisher: [Read original article]() Author: Donal Toomey Published: 2026-08-28T00:00:00Z Content type: tutorial Language: en Sources: [Twilio Blog]() Topics: [Svelte](), [Go Language](), [Vite](), [REST API](), [Single-page application (SPA)](), [Back end](), [Front end]() Tags: [api](), [build-video-app](), [build-video-chat-app](), [cors](), [developer-insights](), [env-file-security](), [environment-variables](), [git](), [go](), [how-can-i-build-a-video-app](), [how-to](), [how-to-create-video-chat-app](), [how-to-make-video-chat-app](), [live-video-chat-app](), [node-js](), [npm](), [real-time](), [svelte](), [twilio-golang](), [twilio-programmable-video](), [twilio-video](), [twilio-video-tutorial](), [video-api](), [video-app](), [video-chat-app](), [vite]() ### AI overview This tutorial explains how to build a real-time video chat app using Svelte for the frontend, Go for the backend, and the Twilio Video API. It covers the application flow, project setup, dependencies, environment configuration, and credential handling. ### Source excerpt Build a real-time video chat app with Svelte 5, Vite, and Go using the Twilio Video API. ## Bun 1.4 lands on Appwrite: the first Bun written in Rust DevFeed: [Bun 1.4 lands on Appwrite: the first Bun written in Rust]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-08-21T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Bun](), [Appwrite](), [Rust](), [OpenTelemetry](), [Playwright]() Tags: [announcements](), [build](), [bun](), [node](), [npm](), [opentelemetry](), [playwright](), [release](), [rust]() ### AI overview Bun 1.4 is available on Appwrite Cloud for Appwrite Functions and Sites. The release is the first Bun version written in Rust and includes improved Node.js 26 compatibility, faster startup and installs, lower memory and idle CPU use, native Web Streams, and new built-in APIs. The article also describes upgrade considerations and benchmarks against Bun 1.3 and Node 26. ### Source excerpt Bun 1.4 is now available as a runtime for Appwrite Functions and as a build runtime for Appwrite Sites. We benchmarked it against Bun 1.3 and Node 26. ## Running the WorkOS API locally DevFeed: [Running the WorkOS API locally]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-17T20:30:39Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [API](), [Testing](), [Development](), [servers](), [SDKs](), [OpenAPI Specification](), [Authentication](), [Open Source]() Tags: [api](), [authentication](), [automated](), [backend](), [bun](), [docker](), [javascript](), [linux](), [local](), [macos](), [npm](), [open-source](), [openapi](), [python](), [tests](), [windows]() ### AI overview This tutorial introduces WorkOS Emulate, an open-source local WorkOS API server for development and automated testing. It explains how to run it locally or in CI, connect WorkOS SDKs by overriding the base URL, and use seeded data for repeatable authentication and integration tests without contacting a live WorkOS environment. ### Source excerpt WorkOS Emulate runs the WorkOS API on your own machine, so your tests can seed real data, drive full login flows, and force failures without touching prod. ## Ship agent skills like packages: discovery index, digests, and install sources DevFeed: [Ship agent skills like packages: discovery index, digests, and install sources]() Original publisher: [Read original article]() Author: Travis Turner (richardturner@evilmartians.com) Published: 2026-08-12T00:00:00Z Content type: tutorial Language: en Sources: [Evil Martians]() Topics: [Agent Skills](), [Agent Skill](), [ai-coding](), [Publishing](), [GitHub](), [make](), [rubygems]() Tags: [agent-experience](), [agent-skill](), [agent-skills](), [ai](), [coding](), [coding-agents](), [dx](), [github](), [jamstack](), [json](), [llms](), [npm](), [rubygems](), [sha-256](), [skills]() ### AI overview This tutorial explains how to publish agent skills so AI coding agents can discover and install them. It covers a .well-known/agent-skills/index.json discovery index, SHA-256 integrity digests, single-file, multi-file, and bundle packaging, multiple install commands, and hosting skills from a GitHub repository while re-hosting the served files on the publisher's domain. ### Source excerpt How to publish agent skills so any AI coding agent can find and install them: the .well-known/agent-skills/index.json discovery index, SHA-256 integrity digests, single-file vs multi-file vs bundle packaging, and every install command. Worked from the catalog we just open-sourced. ## The Appwrite CLI is now written in Go DevFeed: [The Appwrite CLI is now written in Go]() Original publisher: [Read original article]() Author: Chirag Aggarwal Published: 2026-08-11T00:00:00Z Content type: article Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Command-line interface](), [Go Language](), [npm](), [TypeScript](), [JSON]() Tags: [announcements](), [cli](), [dependencies](), [go](), [json](), [npm](), [packages](), [typescript]() ### AI overview Appwrite rewrote its CLI from TypeScript and Node to Go while preserving the command surface, flags, exit codes, and JSON output. Measurements reported in the article show lower startup time, installation size, memory use during push, and binary size. ### Source excerpt The Appwrite CLI moves from TypeScript to Go. It starts 17 times faster and installs two packages in place of 330. Every flag, exit code, and byte of JSON output stays the same. ## Containing Locally Running AI Agents with Layered Security Controls DevFeed: [Containing Locally Running AI Agents with Layered Security Controls]() Original publisher: [Read original article]() Author: Spencer Reeves Published: 2026-08-10T18:00:00Z Content type: tutorial Language: en Sources: [Apartment 304]() Topics: [Artificial Intelligence](), [Security](), [Containers](), [virtualization](), [macOS](), [npm]() Tags: [agent](), [ai-agents](), [apartment-304](), [apple](), [credentials](), [custom-software-solutions](), [devops](), [devops-engineer](), [macos](), [networking](), [npm](), [open-source](), [sandboxing](), [security](), [software-architecture](), [software-development](), [software-engineer]() ### AI overview This article presents a layered security approach for running AI agents locally. It focuses on sandboxing the agent, restricting internet access, and protecting secrets and environment files, with container isolation as the foundation. ### Source excerpt Running an agent locally gives it a foothold on your machine -- here's how we keep it contained. ## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough]() Original publisher: [Read original article]() Author: Harness Team Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ChainDrop](), [npm](), [supply-chain-security](), [Malware](), [npm packages](), [GitHub Actions](), [GitHub]() Tags: [chaindrop](), [ci](), [ci-cd](), [github](), [github-actions](), [integrity](), [least-privilege](), [malware](), [npm](), [npm-worm](), [openid-connect](), [provenance](), [security](), [slsa](), [software-supply-chain-security](), [worm]() ### AI overview The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence. ### Source excerpt ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog ## Marketplace integrations now install provider skills DevFeed: [Marketplace integrations now install provider skills]() Original publisher: [Read original article]() Author: Jathin Singaraju Published: 2026-08-06T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Agent Skills](), [Vercel](), [Command-line interface](), [npm]() Tags: [agent-skills](), [cli](), [integrations](), [npm](), [skills](), [update](), [vercel]() ### AI overview Vercel Marketplace integrations installed through the Vercel CLI now also install the provider's agent skills from skills.sh when available. The update lets agents use an integration immediately, and adds terminal commands for discovering providers and listing Marketplace categories. ### Source excerpt When you install a Vercel Marketplace integration from the Vercel CLI, it now also installs that provider's agent skills from skills.sh, so your agents know how to use it: This happens automatically for any provider that publishes skills. You can also find integrations without leaving the terminal: vercel integration discover browses available providers. vercel integration categories lists all the Marketplace categories they're grouped into, like databases, AI, and observability. Update to the latest Vercel CLI with npm i -g vercel@latest, then read the integration documentation to get started. Read more ## The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign DevFeed: [The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign]() Original publisher: [Read original article]() Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Malware](), [chainguard](), [GitHub](), [C2](), [Ethereum]() Tags: [aws](), [chainguard](), [ethereum](), [github](), [malware](), [mini-shai-hulud](), [npm](), [payload](), [shai-hulud](), [smart-contract](), [supply-chain]() ### AI overview The article examines a 2026 npm supply-chain attack in which a compromised maintainer account was used to publish malicious versions of keyv and cacheable-related packages. It reports credential theft, worm-like propagation to hundreds of downstream packages, and command-and-control infrastructure discovered through an Ethereum smart contract. It also explains that Chainguard customers were protected by malware scanning and package cooldowns. ### Source excerpt The latest npm supply chain attack hit keyv and cacheable. See how Chainguard's malware scanning and cooldowns kept customers protected. ## How to Automate Artifact Cleanup in Harness Artifact Registry Without Breaking Production DevFeed: [How to Automate Artifact Cleanup in Harness Artifact Registry Without Breaking Production]() Original publisher: [Read original article]() Author: Shibam Dhar Published: 2026-08-04T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [container images](), [Docker](), [Maven](), [npm](), [Helm charts](), [Python](), [CI/CD](), [sdlc](), [Microservice]() Tags: [ci-cd](), [cleanup](), [container-images](), [cost](), [deployment](), [docker](), [helm](), [npm](), [python](), [sdlc]() ### AI overview This hands-on walkthrough explains how Harness Artifact Registry lifecycle rules can automate cleanup across Docker, npm, Maven, Python, and Helm repositories while reducing the risk of deleting artifacts still used in production. It describes dry-run previews, governance tiers, recovery, and the limits of age-, count-, and tag-based rules. ### Source excerpt A hands-on walkthrough of Lifecycle Rules across Docker, npm, Maven, Python, and Helm. Includes dry-run preview, three-tier governance, and one-click recovery. | Blog ## Chainguard Libraries now available on AWS Security Hub Extended DevFeed: [Chainguard Libraries now available on AWS Security Hub Extended]() Original publisher: [Read original article]() Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [AWS Security Hub](), [Security](), [software supply-chain attack](), [Malware](), [Open Source](), [Amazon Web Services]() Tags: [ai-coding](), [aws-security-hub](), [axios](), [chainguard-libraries](), [dependencies](), [java](), [javascript](), [litellm](), [malware](), [mini-shai-hulud](), [npm](), [open-source](), [python](), [redhat](), [redhat-cloud-services](), [security](), [shai-hulud](), [software-supply-chain](), [software-supply-chain-attack](), [telnyx]() ### AI overview Chainguard Libraries is now available through AWS Security Hub Extended's Supply Chain category. The article presents it as a malware-free catalog of Python, Java, and JavaScript dependencies intended to reduce reliance on public registries and help protect AWS workloads from software supply-chain attacks. ### Source excerpt Chainguard Libraries is now available in AWS Security Hub Extended, delivering malware-resistant open source dependencies for AWS workloads. ## Share Vercel Container Registry repositories across teams DevFeed: [Share Vercel Container Registry repositories across teams]() Original publisher: [Read original article]() Author: Andy Waller Published: 2026-08-03T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Command-line interface](), [Authorization]() Tags: [cli](), [container-registry](), [images](), [npm](), [registry](), [vercel]() ### AI overview Vercel Container Registry now supports sharing repositories across Vercel teams with read-only access to all images. Recipients can pull and use images but cannot push, delete, or re-share them. ### Source excerpt Vercel Container Registry now lets you share a repository with other Vercel teams to grant read access to its images. Sharing is read-only and covers the whole repository. Recipients can pull and use every image, but cannot push, delete, or re-share. You can also share a repository with your own team. Each repository can be shared with up to 100 teams. Share from the project dashboard under Images -> repository -> Settings -> Repository Sharing, or with the Vercel CLI: # Share a repository with a team vercel vcr permissions my-repository add other-team # List teams with access vercel vcr permissions my-repository ls # Revoke a team's access vercel vcr permissions my-repository rm other-team # Remove all shared access vercel vcr permissions my-repository clear Shared images can be used in Vercel Sandbox, accepting a team-scoped image reference in Sandbox.create() : import { Sandbox } from '@vercel/sandbox'; const sandbox = await Sandbox.create({ image: 'other-team/their-project/shared-repository:latest', }); Repository sharing is available on all plans. Update the Vercel CLI to v58.3.0 or later with npm i -g vercel@latest to get started and see the Vercel Container Registry documentation to learn more. Read more ## How to protect an npm package from supply chain attacks DevFeed: [How to protect an npm package from supply chain attacks]() Original publisher: [Read original article]() Author: Travis Turner (richardturner@evilmartians.com) Published: 2026-07-28T00:00:00Z Content type: tutorial Language: en Sources: [Evil Martians]() Topics: [npm](), [supply-chain-security](), [Security](), [ci](), [GitHub](), [Open Source]() Tags: [2026](), [ci](), [developer-community](), [dx](), [github](), [how-to](), [javascript](), [monorepo](), [npm](), [npm-packages](), [open-source](), [performance-scale](), [security](), [supply-chain](), [supply-chain-security]() ### AI overview This tutorial explains how to protect npm packages from supply chain attacks. It covers Trusted Publishers, publishing restrictions, organization-wide 2FA, GitHub tag controls, pinned CI actions, CI security linting, cooldowns for new versions, and staged-release approval. ### Source excerpt How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings ## How to add authentication and payments to a Webflow Cloud app with Auth0 and Stripe DevFeed: [How to add authentication and payments to a Webflow Cloud app with Auth0 and Stripe]() Original publisher: [Read original article]() Author: Ismail Ajagbe Published: 2026-07-27T00:00:00Z Content type: tutorial Language: en Sources: [Webflow Blog]() Topics: [Auth0](), [stripe](), [webflow](), [Authentication](), [Next.js](), [Web](), [Node.js](), [npm](), [Workers]() Tags: [authentication](), [checkout](), [guides](), [how-to](), [integration](), [next-js](), [node-js](), [npm](), [payments](), [web](), [webflow]() ### AI overview A guide to adding Auth0 session-based authentication and Stripe Checkout payments to a Next.js app hosted on Webflow Cloud. It covers server-side session checks, payment routes, verified webhooks, post-payment provisioning, and Webflow Cloud-specific deployment requirements. ### Source excerpt Learn how to add Auth0 authentication and Stripe Checkout to a Webflow Cloud app, with session middleware, a payment route, and verified webhooks. ## Один файл, одна команда: как мы упростили запуск dev-окружения с помощью Runium DevFeed: [Один файл, одна команда: как мы упростили запуск dev-окружения с помощью Runium]() Original publisher: [Read original article]() Author: thebeastapp ("Лаборатория Касперского") Published: 2026-07-24T14:18:59Z Content type: tutorial Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [Development](), [Open Source](), [JSON](), [Docker](), [npm]() Tags: [dev](), [docker](), [javascript](), [json](), [node-js](), [npm](), [open-source](), [runium](), [source](), [tag-369149f96d73](), [tag-6c1e3d9c9659]() ### AI overview This article describes Runium, an open-source tool developed to simplify local development-environment setup. It uses a JSON file to define the environment, allowing projects to be started, stopped, and checked with one command. The article explains the problem Runium addresses, its origins, implementation, comparisons with other approaches, and an example project. ### Source excerpt Локальный запуск dev-окружения в крупном проекте может превратиться в отдельный квест: несколько процессов, Docker-контейнеры, переменные окружения, порядок старта, ожидание готовности сервисов и отличия между ОС. Даже если у вас есть подобный опыт, это может быть неудобно, долго и утомительно. Новичку же обычно не обойтись без длинной подробной инструкции. Привет, Хабр! На связи Сергей Зверьков, старший разработчик в "Лаборатории Касперского". Хочу рассказать, как мы решили эту проблему, написав собственный open-source-инструмент -- Runium. Суть его в том, что он позволяет описать dev-окружение в JSON-файле. После этого проект можно запускать, останавливать и проверять одной командой. В статье расскажу, из какой боли вырос Runium, как он устроен, сравню его с другими решениями и покажу пример использования на простом веб-проекте. Приступим! Читать далее ## Cypress Ambassador Spotlight: Boris Selivanov DevFeed: [Cypress Ambassador Spotlight: Boris Selivanov]() Original publisher: [Read original article]() Published: 2026-07-24T13:43:32Z Content type: opinion Language: en Sources: [Cypress Blog]() Topics: [Cypress](), [Test automation](), [Testing](), [selectors](), [race-condition](), [Network](), [npm]() Tags: [ambassador](), [automation](), [cypress](), [flaky](), [how-to](), [npm](), [race-condition](), [selectors](), [testing]() ### AI overview This Cypress Ambassador Spotlight presents Boris Selivanov's advice on sharing reusable testing patterns, choosing stable selectors, and building scalable test automation. It highlights cy.intercept() for controlling network traffic and reducing flaky tests, recommends retry-ability and aliases instead of arbitrary cy.wait(ms), and suggests starting with a real application test after installing Cypress. ### Source excerpt What motivates you to be a Cypress Ambassador? I see being an Ambassador as the ultimate form of asynchronous collaboration. My goal is to share things that move the needle for other engineers. By comparing how different teams solve the same testing problems, we can turn isolated project victories into shared wins. How do you currently help others that are either using Cypress or interested in using Cypress? I'm the person teammates ping when a test goes flaky or they're not sure how to appro ## 🍔🧠 Why Linear Feels So Fast (Technical Breakdown) DevFeed: [🍔🧠 Why Linear Feels So Fast (Technical Breakdown)]() Original publisher: [Read original article]() Author: Alexandre Zajac Published: 2026-07-20T15:30:40Z Content type: article Language: en Sources: [Hungry Minds]() Topics: [Caching](), [Local-First](), [client](), [WebSocket](), [Software Engineering](), [Vite](), [npm]() Tags: [cache](), [caching](), [javascript](), [linear](), [local-first](), [npm](), [technical](), [vite](), [websocket]() ### AI overview A technical breakdown of how Linear aims to feel fast by minimizing network latency. It describes local-first state updates, asynchronous synchronization over WebSocket, code splitting, parallel module loading, service-worker precaching, and separately cached dependency chunks. ### Source excerpt PLUS: Virtual memory explained 👨💻, Spark retires vector DBs 💾, Backprop explained simply 🧮 ## Faster, predictable project linking in the Vercel CLI DevFeed: [Faster, predictable project linking in the Vercel CLI]() Original publisher: [Read original article]() Author: Jeff See Published: 2026-07-15T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Command-line interface](), [Vercel](), [releases](), [Release notes](), [ci](), [Git](), [npm]() Tags: [ci](), [cli](), [dev](), [git](), [npm](), [release](), [release-notes](), [vercel](), [workflows]() ### AI overview Vercel CLI 55 improves project linking by resolving the team before searching for projects and by using consistent team and project selection rules across linking commands. It adds more predictable behavior for local, CI, and agent workflows, including promptless linking with explicit organization and project identifiers, and introduces breaking changes requiring explicit team selection in some scripts. ### Source excerpt The Vercel CLI now resolves your team before discovering projects, then searches for projects only in that team instead of sweeping every team you belong to. Linking is faster and more predictable, and every command that establishes a link (vercel link, deploy, pull, dev, and git connect) follows the same flow: Teams resolve from an explicit signal (such as --team, --scope, the scope field in vercel.json, or VERCEL_ORG_ID), if you only have one team, or from a searchable picker. Project suggestions begin with projects already linked to your local Git repository, then fall back to an exact folder-name match before opening up search and project creation across the team. The --yes flag answers confirmations without ever selecting a team for you. For CI and agent workflows, setting VERCEL_ORG_ID and VERCEL_PROJECT_ID makes vercel link fully promptless, while --team or --scope settles the team on any command. When more than one team is available and no signal is set, non-interactive commands fail with an action_required: missing_scope error (JSON output) before they create anything or touch an existing link. Vercel CLI 55 is a major version bump and includes breaking changes. If a script relied on --yes or your globally selected team to pick where a project links, pass the team explicitly: See the vercel@55.0.0 release notes for the full list of changes. Update the Vercel CLI to v55.0.0 or later with npm i -g vercel@latest to get started. Learn more about project linking. Read more ## AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026) DevFeed: [AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)]() Original publisher: [Read original article]() Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub Actions](), [npm packages](), [AsyncAPI Specification](), [Malware](), [GitHub](), [Remote Access Trojan](), [passwords](), [ssh](), [Cloud](), [Cryptocurrency]() Tags: [asyncapi-supply-chain-attack](), [chainguard-asyncapi](), [chainguard-libraries](), [ci](), [cloud](), [cryptocurrency](), [github](), [github-actions](), [github-actions-pwn-request](), [malicious-packages](), [malware](), [miasma](), [npm](), [npm-packages](), [passwords](), [personal-access-token](), [provenance](), [pull-requests](), [remote-access-trojan](), [ssh](), [supply-chain](), [tokens]() ### AI overview The article analyzes a July 14, 2026 supply-chain compromise in which an attacker stole a privileged GitHub personal access token through a misconfigured GitHub Actions workflow and used it to publish five backdoored versions across four AsyncAPI npm packages. The malware activates when a library is loaded by a build or CI job and steals browser passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets while maintaining command-and-control access. It also explains why Chainguard customers were protected and recommends treating affected environments as compromised and rotating credentials. ### Source excerpt A supply chain attack compromised AsyncAPI npm packages via GitHub Actions. See how Chainguard blocked the malicious releases by design. ## The Mastra AI Ecosystem Was Poisoned At The Registry Level DevFeed: [The Mastra AI Ecosystem Was Poisoned At The Registry Level]() Original publisher: [Read original article]() Author: Roshan Piyush Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [software supply-chain attack](), [npm packages](), [Malware](), [Artificial Intelligence](), [CI/CD](), [TypeScript](), [Cloud]() Tags: [ai](), [ci-cd](), [malicious-packages](), [malware](), [mastra](), [npm](), [npm-packages](), [software-supply-chain](), [software-supply-chain-attack](), [typescript]() ### AI overview The article examines a June 17, 2026 software supply-chain attack targeting the Mastra AI TypeScript ecosystem. It reports that a compromised contributor account was used to publish 144 malicious packages under the official @mastra npm scope, with registry-level changes introducing the easy-day-js transitive dependency. Installations during the compromise window could expose developer workstations, CI/CD runners, and cloud environments to an information stealer. ### Source excerpt Learn how the Mastra AI supply chain attack poisoned npm packages, impacted AI pipelines, and how Harness SCS helps detect, block, and remediate compromised dep | Blog [Next page]()