Telnyx package compromised on PyPI(aikido.dev)

70 points by overflowy 7 months ago | 25 comments

Keyv and friends compromised in active Shai-Hulud supply chain attack(aikido.dev)

238 points by cimi_ 2 months ago | 126 comments

Glassworm is back: A new wave of invisible Unicode attacks hits repositories(aikido.dev)

283 points by robinhouston 7 months ago | 169 comments

NPM debug and chalk packages compromised(aikido.dev)

1287 points by universesquid 1 year ago | 699 comments

Aikido Security blog post reporting that the popular npm packages debug and chalk were compromised with malicious code in a supply-chain attack.

Public secrets exposure leads to supply chain attack on GitHub CodeQL(praetorian.com)

285 points by cyberbender 1 year ago | 53 comments

Aikido Code Audit(aikido.dev)

30 points by ilreb 4 months ago | 10 comments

Evolving Threat: http2shell is an RCE in Node, Python, and more(nitter.click)

154 points by cowlevel 2 days ago | 85 comments

A Nitter mirror of an Aikido Security post about http2shell, an HTTP/2-related remote code execution vulnerability affecting Node, Python and others; the page shows only a bot-check link.

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised(socket.dev)

1182 points by jamesberthoty 1 year ago | 965 comments

StepSecurity blog post reporting that @ctrl/tinycolor and 40+ npm packages were compromised by self-propagating malware that steals cloud credentials.

NPM debug and chalk packages compromised(aikido.dev)

1287 points by universesquid 1 year ago | 699 comments

Aikido Security blog post reporting that the popular npm packages debug and chalk were compromised with malicious code in a supply-chain attack.

Today's PHP security release, and how we're strengthening security(thephp.foundation)

761 points by ejohnso49 5 days ago | 394 comments

PHP Foundation blog post on a PHP security release fixing two critical RCE vulnerabilities, how they were found, the disclosure leak, and how PHP security work is being strengthened.

NPM flooded with malicious packages downloaded more than 86k times(arstechnica.com)

349 points by jnord 1 year ago | 248 comments

Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.

MinIO repository is no longer maintained(github.com)

439 points by psvmcc 8 months ago | 318 comments

A GitHub commit to the MinIO repository updating README.md to clarify the project's state, indicating it is no longer maintained.