Open Source Security

The GitHub Account That Was Too Perfect: How Attackers Are Weaponizing Open Source Trust

📅 August 11, 2026 📂 AI & Machine Learning

A pull request on GitHub exposed a new kind of attack: instead of injecting malicious code, attackers are fabricating entire identities to bypass human review. With fake accounts, manufactured credibility, and possibly AI-driven participants, the trust that powers open source has become the attack surface itself.

AI Threats Cybersecurity GitHub Malware Open Source Security Social Engineering Supply Chain Attack

The 127 Million Weekly Download Nobody’s Talking About

📅 August 4, 2026 📂 AI & Machine Learning

Keyv, an npm package with 127 million weekly downloads that most developers never directly install, was compromised via a stolen credential. The real vulnerability isn’t the code—it’s the economic model of open source, where unpaid maintainers silently hold up the internet’s dependency tree, and trust is mistaken for safety.

Dependency Keyv npm Open Source Security Supply Chain Attack Trust