Willison adds tag browsing for 244 vibe-coded tools
Leftover Fable 5.2 credits and tree-sitter were used to tag tools by JavaScript APIs, libraries, and web API hosts.
Stories per day · 30 days
4 RSS
Relatedcryptocurrency3debugbear3magento3polymarket3supply-chain3e-commerce2sansec2web-development2webshell2adobe-commerce1bigsleep1browser1chatgpt1coding-agents1developer-guidance1developer-tools1document-currentscript1dom1
38 stories, newest first · one card per story
Stories tagged #javascript
Google Chrome repo steers coding agents toward modern web primitives
The Show HN post links GoogleChrome/modern-web-guidance and had 25 points and 4 comments.
ChatGPT flaw lets attackers hijack accounts with one link
Researchers demonstrated that a malicious shared ChatGPT conversation could steal private chats and exfiltrate data via one crafted link; OpenAI fixed the issue on October 26.
Polymarket traders drained after DebugBear monitoring script compromised
Trading on the international site paused for about an hour on October 29, and Polymarket says affected users will be reimbursed.
Polymarket users report stolen funds after third-party script compromise
Hudson Rock says malicious JavaScript from a DebugBear address reused logged-in sessions; $2.7 million across 710 wallets is an outside estimate.
1
Polymarket halts trading after crypto-draining script breach, $2.5M traced
Hudson Rock linked a wallet in DebugBear-hosted JavaScript to about 28.6 million POL, roughly $2.57 million.
1
Safari type confusion bug allows remote code execution
CVE-2026-86974 is scored CVSS 8.8 and requires a user to open a malicious page or file.
Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
1
Project Zero: BigSleep beat Fuzzilli on V8 bugs, overlap partial
In six months BigSleep reported 45 V8 vulnerabilities to Fuzzilli's 37, and experiments put theoretical overlap near 60%.
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
2
Zod 4.6.6 compromised by malware?
A Hacker News thread questions whether Zod 4.6.6 was compromised by malware.
A Mere Mortal's Introduction to JIT Vulnerabilities in JavaScript Engines
TrustFoundry's guide explains JIT compiler bugs in JavaScript engines, using V8, D8, and a CTF example.
6
Claude Code's new Mods system lets developers rewrite the AI coding tool from the inside
Anthropic launched Mods, unsandboxed plugins that let developers change Claude Code's tools, commands, and interface.
A Function-level Dataset of Vulnerable and Fixed Source Code in JavaScript and TypeScript
JsVul pairs vulnerable and fixed JavaScript and TypeScript functions from seven sources.
MicroLLM Lab – Try 7 tiny LLM's in the browser
MicroLLM Lab runs seven tiny LLMs (down to 135M parameters) in the browser with JavaScript-written objective benchmarks measuring speed and pass rates.
SCHUTZWERK-SA-2024-006: Stored Cross-Site Scripting via text fields in H5P module (h5p-nodejs-library) of Lumi Education
Stored XSS in Lumi Education h5p-nodejs-library before 9.3.3 runs injected script in viewers' browsers.
Cross-Site Scripting (XSS) Cheat Sheet
PortSwigger's XSS cheat sheet lists filter-bypass patterns for script injection across major browsers, without a new CVE.
2
Malicious npm Packages That Evade Defenses
Schneier highlights malicious npm packages designed to evade existing software supply-chain defenses.
Malicious B-tree NPM Package Accumulates Millions of Downloads
Ongoing NPM supply chain campaign hides malware in indexed-btree's prototype code, reaching 2 million weekly downloads before detection.
1
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
Checkmarx details malicious npm package indexed-btree hiding its loader in runtime code, netting €230,000; Socket flags PolinRider Packagist compromise.
3
Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code
Malicious npm package 'indexed-btree' with 2M weekly downloads hides runtime malware using blockchain-based command-and-control.
State-Aware Fuzzing of JavaScript Engines with LLM-Guided Instrumentation
StateLens uses LLM-guided instrumentation to fuzz JavaScript engines and found 68 bugs.
10 Malicious npm Packages Linked to Runtime Malware Campaign With Millions of Downloads
10 malicious npm packages with millions of downloads bypass install-time checks by loading malware at runtime, using Ethereum for C2.