标签：#pens

GitHub热门项目 | Memory library for building stateful agents | Stars: 4,467 | 599 stars this week | 语言: Python

GitHub热门项目 | Portable DNS resolver in Rust — .numa local domains, ad blocking, developer overrides | Stars: 1,229 | 27 stars today | 语言: Rust

GitHub热门项目 | ⭐️ A cross-platform CLI All-in-One assistant tool for Claude Code, Codex & Gemini CLI. | Stars: 3,041 | 23 stars today | 语言: Rust

GitHub热门项目 | Code at the speed of thought – Zed is a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter. | Stars: 84,059 | 102 stars today | 语言: Rust

GitHub热门项目 | A GPU compute-centric 2D renderer. | Stars: 4,044 | 8 stars today | 语言: Rust

GitHub热门项目 | Your agent writes bad React. This catches it | Stars: 11,481 | 181 stars today | 语言: TypeScript

GitHub热门项目 | A GUI Panel providing Worker subscriptions for VLESS, Trojan and Warp configs alongside a private DoH server and chain proxies, offering full DNS, clean IP, Fragment, Warp, Warp pro and routing settings for cross-platform clients using Amnezia, Wireguard, Sing-box, Clash/Mihomo and Xray cores. | Stars: 10,613 | 44 stars today | 语言: TypeScript

GitHub热门项目 | | Stars: 12,155 | 86 stars today | 语言: TypeScript

GitHub热门项目 | Visual Studio Code | Stars: 185,505 | 62 stars today | 语言: TypeScript

GitHub热门项目 | Project N.O.M.A.D, is a self-contained, offline survival computer packed with critical tools, knowledge, and AI to keep you informed and empowered—anytime, anywhere. | Stars: 26,702 | 294 stars today | 语言: TypeScript

GitHub热门项目 | WebGoat is a deliberately insecure application | Stars: 9,134 | 5 stars today | 语言: JavaScript

GitHub热门项目 | 📄 Configuration files that enhance Cursor AI editor experience with custom rules and behaviors | Stars: 39,770 | 27 stars today | 语言: JavaScript

GitHub热门项目 | Clean Code concepts adapted for JavaScript | Stars: 94,393 | 18 stars today | 语言: JavaScript

GitHub热门项目 | Welcome to a calmer internet | Stars: 42,327 | 67 stars today | 语言: JavaScript

GitHub热门项目 | Turn any PDF or image document into structured data for your AI. A powerful, lightweight OCR toolkit that bridges the gap between images/PDFs and LLMs. Supports 100+ languages. | Stars: 78,940 | 148 stars today | 语言: Python

GitHub热门项目 | PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows. | Stars: 2,489 | 30 stars today | 语言: Python

GitHub热门项目 | Deep Eye orchestrates multiple AI providers (OpenAI, Claude, Grok, Gemini, OLLAMA, Groq, Mistral, OpenRouter, LiteLLM, LM Studio) for intelligent payload generation, scans targets for 45+ vulnerability types, and produces professional reports with compliance mapping. | Stars: 1,562 | 42 stars today | 语言: Python

GitHub热门项目 | 自动化上传视频到社交媒体：抖音、小红书、视频号、tiktok、youtube、bilibili | Stars: 11,582 | 185 stars today | 语言: Python

GitHub热门项目 | A platform for reproducible world model research and evaluation | Stars: 1,058 | 346 stars today | 语言: Python

Supply chain attacks every other morning Unless you've lived under a rock for the last few months, you probably noticed that software supply chain attacks are getting trendy among threat actor groups. Over the last 12 months, we've seen more of those than ever before, to name only a few of them: tj-actions/changed-files : In March 2025, a popular reusable GitHub application workflow was compromised to dump secrets from CI/CD pipelines. Salesloft Drift : In August 2025, threat actors stole OAuth credentials from the compromised Drift chatbot application. Shai-Hulud : In September and November 2025, a wormed attack propagated through npm packages and collected secrets. The common thread among those incidents is that they all revolved around secrets, one way or another. Some used secrets as an initial access vector, and others were focused on collecting secrets from victim environments. March 2026 did not change the state of things, with two new severe attacks added to our dreadful collection: trivy-action & LiteLLM campaign by Team PCP. The most popular Axios package compromise. Both those attacks followed a now-classical pattern, spreading through compromised open-source dependencies to maximise the impact in the shortest possible time. Your all-time classic, now with added internal threats Open-source supply chain attacks are not new. Ever since we started using centralized open-source package registries, the risk has existed. Threat actors understood this and started exploiting it. What has changed since 2015 is how we have improved software development productivity through automation. And now, this very same automation that lets you test and build your projects without typing a single command is amplifying the supply-chain threat and the velocity of attacks. Let's see how. Keeping your malware up to date A very concerning pattern we've observed in the trivy-action and Axios campaigns is that automation can become the source of your compromise. One thing no develop