https://fresh-reads.lovable.app/What developers should know about, and what to do — from advisory databases and the researchers who find supply-chain malware.Sun, 01 Nov 2026 08:57:41 +0000https://github.com/nexlabz/snare/releases/tag/v1.6.02638dbd58d4d3ff2Sun, 25 Oct 2026 13:15:12 +0000snare now knows which package versions are malware, for npm, Python, Rust, Go and more, and stops them before they install. Supply-chain malware isn't only an npm problem anymore. This month, LiteLLM's release pipeline was hijacked, and version 1.107.0 on PyPI shipped a file that — What to do: Update: `snare update`. [confirmed · snare]snarehttps://github.com/nexlabz/snare/releases/tag/v1.5.087a19720f0b00003Wed, 14 Oct 2026 22:51:56 +0000snare now checks code before your coding agent pulls it in or runs it, and shows you what it found. The incident behind this release was ordinary work: a pull, an install, npm run dev. A coding agent did it in a repository that had been poisoned upstream, and nobody found out for — What to do: Update: `snare update`. [confirmed · snare]snarehttps://github.com/nexlabz/snare/releases/tag/v1.4.3416caaeb31b77c3fTue, 13 Oct 2026 20:46:46 +0000Found by purging a real repository and then scanning what came back. A 29,057-byte api.js survived the rewrite, and the purge printed blobs still carrying a hidden payload: 0. The verify step re-runs the same cleaner, so anything the cleaner cannot see verifies clean — a false cl — What to do: Update: `snare update`. [confirmed · snare]snarehttps://github.com/nexlabz/snare/releases/tag/v1.4.2bcd7bd1ef372b046Tue, 13 Oct 2026 00:42:41 +0000Found by running 1.4.1 against a real repository rather than a fixture. The false positive node\s+.*(-e|--eval) left the flag unanchored, so atlas-engine matched. An honest PostToolUse hook running packages/atlas-engine/hooks/atlas-tag.ts was reported as *"an agent hook runs a dr — What to do: Update: `snare update`. [confirmed · snare]snare