Tuesday, May 12, 2026 8 stories

Today on the desk: a self-propagating npm/PyPI worm that shipped malware with valid SLSA provenance, fresh CVEs in urlli…