News and Tech Update

A malicious npm package that has been downloaded millions of times comes with a new way of spreading the malware that makes it easier to bypass security protections, say researchers with security vendor Checkmarx. Rather than using more common preinstall or postinstall scripts, the bad actors instead created a malicious package – indexed-btree – that mimics the legitimate sorted-btree package and hides the malware in the package’s runtime code, according to Checkmarx security researcher Bruno Dias. Indexed-btree “runs entirely from application code at runtime,” Dias wrote in a report . “Additionally, this package achieved almost 2 million weekly downloads, which shows not much has changed in the npm ecosystem despite the limitations put on lifecycle scripts.” The latest malware targeting npm packages hides inside the Btree.prototype.set, the standard method in JavaScript B-Tree data structures. Because there’s no install hook inside the package.json file, installing the packag...

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role, it tends to create opportunities for others. The ten job postings shared this week are selected based on the company looking to hire, the vertical industry segment and naturally, the pay scale being offered. We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration. Dice Booz Allen Hamilton McLean, VA DevOps Engineer $77,600 to $176,000 Alarm.com Centennial, CO DevOps Engineer $120,000 to $130,000 HarbourVest Partners Boston, MA DevOps Engineer $135,00...

GitLab is introducing new rate limits for its cloud-based DevOps platform as growing demand from AI agents and automated development tools increases pressure on its infrastructure. The changes , which begin October 19, will restrict the volume of requests users can send to GitLab.com based on their subscription plans. Free-tier customers and users making unauthenticated requests will face the new restrictions first, while Premium and Ultimate customers will see changes in January 2027. The restrictions address a challenge facing developer platforms as AI coding agents generate vast volumes of automated requests. GitLab forecasts several times more traffic on its infrastructure for 2026, prompting the company to establish usage limits designed to maintain service performance. GitLab is certainly not alone in addressing this issue. GitHub and Anthropic have also introduced rate limits as AI-powered development tools greatly boost the use of computing and network resources. Automated ...

Anyone with write access to a repository can trigger a GitHub Actions workflow. That has been the default since Actions launched. It’s convenient. It’s also a problem when a compromised account or a malicious pull request can turn your CI into an attack path. Attackers have noticed. GitHub’s own 2026 Actions security roadmap points to incidents involving tj-actions/changed-files, Nx, and trivy-action as examples of the same pattern. Go after the automation, not the application. Steal a token, and you own the pipeline. Mitch Ashley, vice president and practice lead for CIO & technology buyers and software lifecycle engineering at The Futurum Group , puts the stakes plainly. “A single compromised developer account can mean the difference between a well-running pipeline and compromised software.” GitHub’s latest answer is now generally available. On September 17, the company made workflow execution protections GA for GitHub Enterprise, organizatio...

A federal appeals court handed GitHub, Microsoft, and OpenAI an important win in the first major appellate ruling over how AI coding tools can use open-source code. As we all know, all the AI code-generating programs learned their lessons largely from open-source code. So a group of anonymous open-source plaintiffs argued that GitHub Copilot and OpenAI Codex were built using code from public GitHub repositories, including open-source licensed code. They argued the AI tools had generated code without the author attribution, copyright notices, and license terms that came with the original work. Now, the Ninth Circuit has returned a verdict in Doe vs. GitHub siding with Big AI. Ouch! But it may not be as troublesome as it first appears. The Ninth Circuit’s September 16 decision turns on a technical but consequential distinction: AI-generated code that lacks author names, copyright notices, and license information is not necessarily the same as code from which that information has been...

Your team probably spends considerable effort securing your application. WAFs, rate limiting, input validation, penetration testing. Then code passes through a CI/CD pipeline that runs with privileged credentials, executes arbitrary code from third-party actions, has broad network access to internal systems, and logs secrets in plain text if someone makes one configuration mistake. The pipeline that builds and deploys your secure application is itself the least secure system in your infrastructure. Think about what a CI/CD pipeline actually is from an attacker’s perspective. It is a system that automatically executes code, often with administrative access to your cloud accounts, container registries, databases, and production environments. It pulls dependencies from the public internet. It runs plugins and actions written by strangers. It often has access to every secret needed to deploy to every environment. If you designed a system specifically to be an attractive target for s...

Anyone who has run more than one Claude Code session at a time on the same codebase already knows the drill. You split the work yourself, decide which session touches which files, track what each one is doing, and then stitch the results together by hand. The model can write good code in parallel. Coordinating that parallel work has been left entirely to humans. Anthropic is trying to close that gap. On September 17, the company rolled out a redesign of Claude Projects that moves it from a static container for files and chat history into something closer to a project manager: A coordinator that breaks a stated goal into parallel threads, delegates the work, and assembles the results. The mechanics are straightforward once you see them. A user states a goal and connects the relevant repositories or context, and a coordinator thread scopes the work and spins up worker threads to handle pieces of it. Each of those threads runs as a full Claude Code cloud session on its own branch, and c...

Anthropic announced it has redesigned Claude Projects to coordinate multiple coding sessions in parallel, with the new experience debuting in beta for Claude Code users. In the redesigned Projects, a coordinator can break a development goal into separate threads, assign them to individual Claude Code cloud sessions and track their progress from one shared project. The beta is initially available to select Claude Pro and Max subscribers using Claude Code cloud sessions, with wider Pro and Max access coming over the next week. Updated Projects across the rest of Claude and on Team and Enterprise plans will follow. The naming may be confusing because Anthropic already uses “Projects” for its general-purpose Claude workspaces. Anthropic describes this as a new version of that existing feature, rather than a separate Claude Code product. The redesign is debuting in Claude Code, while existing Projects in chat and Cowork will continue to work for now and be upgraded as the rollout expands....

StackHawk this week launched Wingman , an artificial intelligence (AI) tool that makes it possible for application developers to automatically fix vulnerability issues as code is being written. Wingman is designed to install into Claude Code, Cursor, GitHub Copilot, Codex, and Antigravity. It scans the live application, interprets findings, and fixes vulnerabilities in a way that makes it simpler for application developers to maintain context as they write code. At the core of those capabilities, StackHawk’s application testing platform is made available through a set of AI skills, hooks and rules that Wingman invokes. Once an AI coding agent finishes a feature, Wingman auto-configures and boots the running application to run a series of security tests with no manual steps required. Findings are then shared with the AI coding agent that wrote the code to fix any issues discovered. Wingman then rescans that application to confirm the fix held before reporting back to the continuous in...

Harness today previewed a revamped user interface for its platform for managing software deployments that makes it simpler for software engineers to manage teams of artificial intelligence (AI) agents using a forthcoming Harness Software Factory platform. Speaking at an {unscripted} NYC 2026 event , Harness CEO Jyoti Bansal told conference attendees the Harness Software Factory will make it simpler for DevOps teams to enforce standards across agentic AI engineering workflows. Rather than allowing AI agents to reinvent the way an application is developed every time, the Harness Software Factory makes use of specifications to enforce standards in a way that both applies controls and ultimately reduces the number of tokens that might otherwise be consumed. Harness also previewed Vibe Mode for Harness, an interface for the Harness platform that applies policies to code being developed by so-called citizen developers who are generating code using AI tools. Finally, Harness revealed a Fle...

Two modules in a repository had near-identical Azure DevOps build and release definitions. A third would have required another pair. The delivery chain used five definitions: one change decider, two builds, and two releases. I consolidated it into one decider, one generic build, and one release with a deployment stage for each onboarded module. The count excludes package and pull request validation. Figure 1. The consolidation removed one duplicated build and one duplicated release. The Decider Passes the Module as a Run Parameter The old builds repeated the same image and chart tasks with different module values. The releases repeated the same deployment tasks with different variable groups. A shared build change required matching edits in both build definitions, and a shared deployment change required matching edits in both release definitions. Adding another module would have required another build and release pair. I named the shared definitions by product, service, scope, an...

Splunk is gearing up to make an artificial intelligence (AI) model for analyzing log data available on Hugging Face under an open source license. Additionally, Splunk at its .conf26 conference this week revealed it is developing a Universal Collector, expected to be available in beta in 2027, to streamline collection of all types of telemetry data using an instance of OpenTelemetry. Raja Mukhopadhyay, vice president of observability cloud for the Splunk arm of Cisco, said a large language model (LLM) that has been trained to reason across log data will make it possible for DevOps teams to observe AI applications and agents at scale. The Universal Collector, meanwhile, lays the foundation for unifying DevOps, IT operations and security operations by making it simpler to correlate events without having to deploy separate repositories for different types of telemetry data. Previously, Splunk has made available an open source Cisco Time Series Model 1.0 on Hugging Face that has been s...

AI agents are becoming operational teammates. They can ingest alerts, query logs and traces, correlate deployment events, consult runbooks and recommend or perform remediation. Their promise is not merely faster summarization: It is a shorter path from detection to safe recovery. But an agent that can explain an incident is not automatically an agent that should change production. Restarting a stateless pod, rolling back a customer-facing payment deployment and responding to a suspected credential compromise are materially different decisions. Each requires a different amount of evidence, human accountability and execution control. The practical answer is tiered autonomy. Tier 1 automates well-understood and reversible incidents. Tier 2 lets the agent investigate and recommend, while a human explicitly approves the action. Tier 3 keeps people in command for novel, complex or high-impact incidents while the agent accelerates evidence collection and hypothesis testing. The three tiers...