DevEx
mise Wants to Run Your Whole Dev Environment. The 'Reproducible' Part Needs an Asterisk
mise puts your languages, env vars, and tasks in one file. We checked whether 'reproducible' holds up.
Tagged with
supply-chain
Open Source
uv 0.11.19 Hashes Every Download and Quietly Grows a Type Checker
uv 0.11.19 hashes every download and grows a type checker. The Python toolchain keeps collapsing into one binary.
DevEx
GitHub Introduces a Package Manager for Prompts, Supply Chain Headaches Included
'Skills are not verified by GitHub.' It's npm for prompts with a formal hands-off security policy.
Security
GlassWorm Uses Zig Dropper to Silently Infect Every IDE on Your Machine
One fake WakaTime extension on Open VSX, one Zig binary, and every VS Code-compatible editor on your machine is compromised in seconds.
AI Tools
OpenAI's macOS Signing Pipeline Got Hit by a 3-Hour npm Compromise
A floating semver tag in CI and a three-hour window on npm were enough for poisoned axios to reach code-signing certificates.