JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Directly inherited from ViT (DeiT), YOLOS is not designed to be yet another high-performance object detector, but to unveil the versatility and transferability of Transformer from image recognition to ...

The offices of Google are pictured in London on February 28, 2026. JUSTIN TALLIS/AFP via Getty Images Google released agents-cli on April 21, 2026, and it has shipped 13 updates in the 71 days since — ...

New benchmarks show semantic code graphs helping coding agents find change locations faster and complete updates more ...

现有工程与学术研究存在两处明显短板：第一，多数供应链安全研究聚焦 OAuth 令牌防护、第三方供应商准入审计，未结合 CRM 数据泄露后的定向钓鱼衍生威胁开展联动分析；第二，现有钓鱼检测模型未引入客户泄露业务画像特征，无法区分普通泛化钓鱼与高欺骗性定向钓鱼，缺少适配 SaaS 企业客户防护的轻量化检测代码与落地流程。基于上述现实痛点，本文以 LastPass 供应链泄露事件为核心案例，系统拆解定向 ...

如果你是 Claude Code 的日常用户，又对 AI Agent 开发感兴趣——装。 adk-code + scaffold + eval 这三个 Skill 组合起来，能把你的 Claude Code 从「写代码的助手」变成「帮你搭 Agent 系统的搭档」。 上周我刷 GitHub Trending 的时候，看到一个仓库两天 ...

A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely ...

Skill Eval Harness is a Python CLI for testing whether an Agent Skill changes observable output. It reads evals/shared-benchmark.json, emits answer-key-safe task rows, grades files under eval-runs/, ...