First screen, captured .
813 points by psxuaw | 427 comments
Short blog post by Xe Iaso noting new Linux kernel vulnerabilities and advising a week-long pause on installing new software due to supply chain attack risk.
444 points by guntars | 138 comments
Blog post describing building an HTTPS web server in Rust using io_uring and kernel TLS to avoid system calls on the request path.
123 points by xena | 104 comments
76 points by xena | 24 comments
1287 points by universesquid | 699 comments
Aikido Security blog post reporting that the popular npm packages debug and chalk were compromised with malicious code in a supply-chain attack.
349 points by jnord | 248 comments
Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.
742 points by birdculture | 426 comments
Andrew Nesbitt's blog post arguing that package managers like Cargo repeatedly use git repositories as registry databases and run into scaling problems.
330 points by OuterVale | 181 comments
GitLab blog post describing a widespread npm supply chain malware attack that includes a "dead man's switch" capable of harming user data.
367 points by tosh | 263 comments
GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.
355 points by wonger_ | 106 comments
A myNoise blog post by founder Stéphane describing a hacker's attack on the myNoise website, first via code-injection attempts and then a different strategy.