GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, ...
How-To Geek on MSN

Node.js is changing its release cycle, just as Chrome switches to faster upgrades

Slow and steady.

Oracle unveils Project Detroit for faster Java interop with JavaScript and Python

JavaOne Oracle has shipped Java 26, a short-term release, and introduced Project Detroit, which promises faster interop between Java, JavaScript, and Python. Java 26 will be supported for just six ...

Web framework: Astro 6.0 experiments with new Rust compiler

An experimental Rust compiler is intended to replace the previous Go compiler, and the Astro dev server now supports custom runtimes.
How-To Geek on MSN

Update Google Chrome now to fix two more zero-day security vulnerabilities

Chrome on Windows, Mac, Linux, and Android are affected.
InfoQ

Webpack Publishes 2026 Roadmap with Native CSS Support, Universal Target, and Path to Version 6

Webpack's 2026 roadmap, led by Even Stensberg, unveils substantial enhancements aimed at modernizing the bundler. Key ...

Supply-chain attack using invisible code hits GitHub and other repositories

Researchers say they’ve discovered a supply-chain attack flooding repositories with malicious packages that contain invisible code, a technique that’s flummoxing traditional defenses designed to ...

Toolchain for web development: Vite+ becomes open source

Originally planned with a paid tier for companies, the alpha version of Vite+ has now been released as open source.