Config Files That Run Code: Supply Chain Security Blindspot(safedep.io)

62 points by signa11 4 months ago | 19 comments

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor(safedep.io)

582 points by abhisek 5 days ago | 192 comments

SafeDep analysis of the compromised LiteLLM 1.107.0 PyPI release, which installed a credential stealer and remote-code backdoor via .pth and sitecustomize files, with IOCs.

Malicious Rust crate Arrayref runs a build-time payload(safedep.io)

532 points by abhisek 2 months ago | 468 comments

SafeDep blog post analyzing a malicious version of the Rust crate arrayref that executes a payload at build time via a supply-chain attack.

Telnyx package compromised on PyPI(aikido.dev)

70 points by overflowy 7 months ago | 25 comments

GitHub Copilot code review will start consuming GitHub Actions minutes(github.blog)

249 points by whtsky 6 months ago | 172 comments

Setting Up an RK3588 SBC QEMU Hypervisor with ZFS on Debian(blog.kumio.org)

59 points by kumiokun 1 year ago | 17 comments

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised(socket.dev)

1182 points by jamesberthoty 1 year ago | 965 comments

StepSecurity blog post reporting that @ctrl/tinycolor and 40+ npm packages were compromised by self-propagating malware that steals cloud credentials.

NPM flooded with malicious packages downloaded more than 86k times(arstechnica.com)

349 points by jnord 1 year ago | 248 comments

Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.

Shai-Hulud Returns: Over 300 NPM Packages Infected(helixguard.ai)

967 points by mrdosija 11 months ago | 733 comments

HelixGuard blog post reporting that the Shai-Hulud worm returned, infecting over 300 npm packages via a fake Bun runtime within hours.

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware(github.com)

367 points by tosh 1 year ago | 263 comments

GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.

NPM debug and chalk packages compromised(aikido.dev)

1287 points by universesquid 1 year ago | 699 comments

Aikido Security blog post reporting that the popular npm packages debug and chalk were compromised with malicious code in a supply-chain attack.

Upcoming breaking changes for npm v12(github.blog)

459 points by plasma 4 months ago | 189 comments

GitHub Changelog post announcing upcoming breaking changes in npm version 12.