Disrupting supply chain attacks on NPM and GitHub Actions(github.blog)

77 points by nyku 2 months ago | 26 comments

Obsidian 1.4.10 Desktop (Public)(obsidian.md)

81 points by l2dy 3 years ago | 44 comments

Obsidian 1.5 Desktop (Public)(obsidian.md)

159 points by l2dy 2 years ago | 129 comments

Public secrets exposure leads to supply chain attack on GitHub CodeQL(praetorian.com)

285 points by cyberbender 1 year ago | 53 comments

The Future of Obsidian Plugins(obsidian.md)

426 points by xz18r 5 months ago | 151 comments

Obsidian blog post announcing Obsidian Community, a new directory and developer dashboard for Obsidian plugins and themes.

JSON Canvas: an open file format for infinite canvas data(obsidian.md)

23 points by notsahil 2 years ago | 1 comments

DuckDB Doesn't Need Data to Be a Database(nikolasgoebel.com)

353 points by tosh 2 years ago | 115 comments

A blog post by Nikolas Göbel discussing how DuckDB can act as a database without storing data itself, querying external data sources directly.

RCE Vulnerability in React and Next.js(github.com)

559 points by rayhaanj 10 months ago | 214 comments

GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.

A supply chain attack on PyTorch(johnstawinski.com)

444 points by roblabla 2 years ago | 92 comments

Blog post by John Stawinski describing how his team executed a critical supply chain attack on PyTorch via its GitHub Actions CI infrastructure.

RCE Vulnerability in QBittorrent(sharpsec.run)

352 points by udev4096 2 years ago | 173 comments

Security blog post disclosing that qBittorrent's DownloadManager ignored SSL certificate errors for 14 years, enabling remote code execution, fixed in version 5.0.1.

Node.js Vulnerability Blog(nodejs.org)

6 points by Brysonbw 2 days ago | 1 comments

The Node.js blog's Vulnerabilities category page, listing 2026 security release announcements, an OpenSSL advisory assessment, and a V8 HashDoS post.

Bitwarden CLI compromised in ongoing Checkmarx supply chain campaign(socket.dev)

844 points by tosh 6 months ago | 412 comments

Socket Research blog post reporting that Bitwarden CLI 2026.4.0 was compromised via an abused GitHub Action as part of the Checkmarx supply chain campaign.