Four Supply Chain Attacks Hit npm and PyPI Between June and July 2026

·14 views

Between early June and July 14, 2026, four separate supply chain attacks targeted the npm and PyPI open-source package ecosystems. The Miasma worm, previously identified on npm, spawned a PyPI variant called Hades that spread across at least 29 packages by using a Python startup file to execute credential-harvesting payloads. A separate campaign deployed roughly 17 fake payment SDK packages mimicking providers like PaySafe and Skrill, silently stealing API keys and tokens from CI environments while returning normal-looking responses to developers. Attackers also used stolen publishing credentials to push malicious versions of the jscrambler package and several of its build-tool plugins, which collectively carry millions of weekly downloads. Across all four incidents, the common objective was to compromise developer environments and build pipelines in order to exfiltrate credentials.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How AI Tools Like Claude and Copilot Are Speeding Up Code Reviews

Developers are increasingly using AI tools such as Claude, ChatGPT, and GitHub Copilot to assist with code reviews, handling routine checks for bugs, security flaws, and performance issues in seconds. These tools can be integrated into CI/CD pipelines via GitHub Actions, automatically flagging potential problems before a human reviewer ever opens a pull request. The approach is not meant to replace human reviewers but to filter out repetitive, low-level issues so engineers can focus on architecture and business logic. Pricing varies by tool, with options ranging from per-review API costs to flat-rate business subscriptions, and most offer free tiers for experimentation. Practitioners note that AI reviews are not infallible and work best when combined with human judgment, particularly for context-specific or design-level decisions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Earth Adds Gemini AI Chat and Imagery Search for Web Users

Google Earth on the web has introduced two experimental Gemini-powered features: Ask Google Earth, a chat interface for natural-language geospatial analysis, and Imagery search, a multimodal tool for finding relevant satellite and aerial imagery. Ask Google Earth allows users to query the map using the active viewport, selected features, or defined areas as context, reducing the need to manually describe geographic details. The Imagery search feature scans satellite and aerial imagery to surface potentially relevant visual results, returning up to 30 non-authoritative leads that require human verification. Both features are currently experimental and available only to Professional and Professional Advanced users in the United States. Google emphasizes that the tools are meant to assist with faster discovery and preliminary analysis, not to replace established geospatial review workflows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TypeScript readonly Arrays Offer Surface-Level Safety, Not Deep Immutability

TypeScript's readonly modifier prevents reassignment and blocks mutation methods like push or splice on arrays and tuples, but only at the top level — nested objects within a readonly array remain freely mutable. The two readonly syntaxes, ReadonlyArray<T> and readonly T[], compile to identical runtime code and differ only in ergonomic preference. A common pitfall is type widening during function calls, which silently strips readonly from literals unless developers use as const assertions or explicit type annotations. Achieving true deep immutability requires recursive utility types like DeepReadonly or as const assertions, both of which carry ergonomic and type-inference trade-offs. Experts recommend applying strict readonly patterns selectively based on domain risk, such as in financial logic, rather than treating it as a universal safety guarantee.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Ways to Auto-Restart a Python Script After a Crash, Compared

Python scripts that crash due to unhandled exceptions stay dead until manually restarted, posing a reliability problem for bots, workers, and pollers meant to run continuously. Developers have four main options to address this: a bash while loop, a try/except block around the main function, systemd's Restart=on-failure directive, and a third-party library called StayPresent. The bash loop is simple but restarts endlessly without limits, while the try/except approach keeps the same process alive, risking restarts into a corrupted memory state. Systemd offers robust supervision with restart caps but requires system-level access unavailable on most PaaS platforms like Render or Railway. StayPresent runs the script as a managed subprocess with configurable restart limits and backoff, works across PaaS, Docker, and VPS environments, and correctly distinguishes a clean exit from a genuine crash.

0 comments Read more at DEV Community