LEMON BLOG

A newly disclosed Visual Studio Code vulnerability has raised concern among developers and organisations that rely heavily on GitHub and browser-based coding environments. The issue affects VS Code's webview implementation and could allow attackers to steal GitHub OAuth tokens by tricking a user into clicking a malicious link.

A new npm supply-chain incident involving packages under Red Hat's @redhat-cloud-services namespace has once again highlighted how attractive developer ecosystems have become to attackers. Instead of going directly after end users, modern threat actors are increasingly targeting the tools, libraries and publishing pipelines that developers trust every day.

A newly uncovered npm threat is a sharp reminder that not every package pretending to be a helpful developer tool is what it claims to be. Security researchers at JFrog say a malicious package named @openclaw-ai/openclawai was uploaded to npm on 3 March 2026, disguised as an OpenClaw installer for macOS developers. Instead of installing anything legitimate, the package reportedly deployed a multi-stage malware chain designed to steal sensitive data and establish long-term remote access on infected machines. JFrog calls the campaign GhostClaw.