Social engineering campaign targeting tech employees spreads through NPM malware(socket.dev)

106 points by feross 3 years ago | 71 comments

Public secrets exposure leads to supply chain attack on GitHub CodeQL(praetorian.com)

285 points by cyberbender 1 year ago | 53 comments

Axios compromised on NPM – Malicious versions drop remote access trojan(stepsecurity.io)

1891 points by mtud 6 months ago | 763 comments

StepSecurity blog post reporting that a hijacked maintainer account published malicious axios versions 1.14.1 and 0.30.4 on npm that drop a cross-platform RAT.

FSF trying to contact Google about spammer sending 10k+ mails from Gmail account(daedal.io)

354 points by pabs3 6 months ago | 203 comments

A Mastodon post by Thom Zane asking for a human contact on Google's Gmail team to report a spammer who sent 10,000+ spam emails via Gmail.

Kaspersky exposes hidden malware on GitHub stealing personal data(kaspersky.com)

154 points by 01-_- 1 year ago | 84 comments

Telnyx package compromised on PyPI(aikido.dev)

70 points by overflowy 7 months ago | 25 comments

I found 10k GitHub repositories distributing Trojan malware(orchidfiles.com)

927 points by theorchid 4 months ago | 240 comments

A blog post describing the discovery of about 10,000 GitHub repositories distributing Trojan malware and the shared pattern used to find them with a script.

How we hacked McKinsey's AI platform(codewall.ai)

420 points by mycroft_4221 7 months ago | 168 comments

CodeWall blog post describing how its autonomous offensive agent found vulnerabilities in McKinsey's internal AI platform Lilli.

Malicious versions of Nx and some supporting plugins were published(github.com)

427 points by longcat 1 year ago | 421 comments

GitHub security advisory from the nrwl/nx repository reporting that malicious versions of Nx and several supporting npm plugins were published.

We used an AI agent to fix an open-source bug. Someone asked to ban us(github.com)

9 points by maxcr 1 month ago | 2 comments

A GitHub pull request to the VisiData project submitted using an AI agent to fix a bug, which drew a request to ban the contributors.

Open source security at Astral(astral.sh)

344 points by vinhnx 6 months ago | 95 comments

Astral blog post by William Woodruff describing the techniques Astral uses to secure its open source tools and their build, test, and release processes against supply chain attacks.

I'm being cyberattacked by Tesla, Inc(dreamstation.systems)

389 points by robinpie 1 month ago | 109 comments

Personal blog post describing persistent attack traffic in nginx logs from IPs with Host/Referer headers pointing to pool-ntp.tesla.com.