Fosstodon

11 posts10 participants0 posts today

Habr[Перевод] Когда ИИ становится троянским конем: 43% «галлюцинированных» имен пакетов регулярно повторяются в сгенерированном кодеAI-помощники регулярно "галлюцинируют" несуществующие пакеты, а злоумышленники используют эти имена для размещения вредоносного кода в репозиториях. Исследования показывают, что 5.2% рекомендаций пакетов от коммерческих моделей не существуют, а для open-source моделей этот показатель достигает 21.7%. Эта техника, названная "слопсквоттингом" (slopsquatting), особенно опасна в эпоху "vibe coding", когда разработчики безоговорочно доверяют рекомендациям AI.<a href="https://habr.com/ru/articles/901198/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://habr.com/ru/articles/901198/</a><a href="https://zhub.link/tags/%D0%B8%D1%81%D0%BA%D1%83%D1%81%D1%81%D1%82%D0%B2%D0%B5%D0%BD%D0%BD%D1%8B%D0%B9_%D0%B8%D0%BD%D1%82%D0%B5%D0%BB%D0%BB%D0%B5%D0%BA%D1%82" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#искусственный_интеллект</a> <a href="https://zhub.link/tags/%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D0%B1%D0%B5%D0%B7%D0%BE%D0%BF%D0%B0%D1%81%D0%BD%D0%BE%D1%81%D1%82%D1%8C" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#кибербезопасность</a> <a href="https://zhub.link/tags/slopsquatting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#slopsquatting</a> <a href="https://zhub.link/tags/%D1%80%D0%B0%D0%B7%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D0%BA%D0%B0" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#разработка</a> <a href="https://zhub.link/tags/%D0%B3%D0%B0%D0%BB%D0%BB%D1%8E%D1%86%D0%B8%D0%BD%D0%B0%D1%86%D0%B8%D0%B8_%D0%B8%D0%B8" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#галлюцинации_ии</a> <a href="https://zhub.link/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://zhub.link/tags/pypi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pypi</a> <a href="https://zhub.link/tags/vibecoding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vibecoding</a>

Thomas Svensson 🖖Practicing to improve my <a href="https://fosstodon.org/tags/NPM" class="mention hashtag" rel="tag">#NPM</a> at <a href="https://vim-racer.com/" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://vim-racer.com/</a>Personal best thus far: 61

Rad Web HostingHow to Install <a href="https://mastodon.social/tags/Directus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Directus</a> on <a href="https://mastodon.social/tags/AlmaLinux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AlmaLinux</a> <a href="https://mastodon.social/tags/VPS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VPS</a> Here's a step-by-step guide detailing how to install Directus on AlmaLinux VPS. What is Directus? Directus is an open-source <a href="https://mastodon.social/tags/headless" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#headless</a> <a href="https://mastodon.social/tags/CMS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CMS</a> and data platform that allows you to manage and interact with your database through a RESTful API or GraphQL API. It provides a modern, user-friendly admin interface for ... Continued 👉 <a href="https://blog.radwebhosting.com/how-to-install-directus-on-almalinux-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=ReviveOldPost" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.radwebhosting.com/how-to-install-directus-on-almalinux-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=ReviveOldPost</a> <a href="https://mastodon.social/tags/cmsapps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cmsapps</a> <a href="https://mastodon.social/tags/nodejs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nodejs</a> <a href="https://mastodon.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://mastodon.social/tags/vpsguide" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vpsguide</a> <a href="https://mastodon.social/tags/installguide" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#installguide</a> <a href="https://mastodon.social/tags/selfhosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfhosting</a> <a href="https://mastodon.social/tags/letsencrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#letsencrypt</a> <a href="https://mastodon.social/tags/selfhosted" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfhosted</a> <a href="https://mastodon.social/tags/postgresql" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#postgresql</a>

Ryan Daws 🤓Masquerading payment npm package installs backdoor <a href="https://www.developer-tech.com/news/masquerading-payment-npm-package-installs-backdoor/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.developer-tech.com/news/masquerading-payment-npm-package-installs-backdoor/</a> <a href="https://techhub.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://techhub.social/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://techhub.social/tags/developers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#developers</a> <a href="https://techhub.social/tags/coding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#coding</a> <a href="https://techhub.social/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#programming</a> <a href="https://techhub.social/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://techhub.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://techhub.social/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://techhub.social/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech</a> <a href="https://techhub.social/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a> <a href="https://techhub.social/tags/technology" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#technology</a>

OTX BotAtomic and Exodus crypto wallets targeted in malicious npm campaignA malicious npm package named pdf-to-office was discovered targeting cryptocurrency wallets. The package, posing as a PDF to Office converter, injects malicious code into locally installed Atomic and Exodus wallets. This attack modifies legitimate files to redirect crypto funds to the attacker's wallet. The campaign shows persistence, as removing the malicious package doesn't remove the injected code from the wallets. Multiple versions of both wallets were targeted, with the attackers adapting their code accordingly. This incident highlights the growing scope of software supply chain risks, particularly in the cryptocurrency industry, and emphasizes the need for improved monitoring of both source code repositories and locally deployed applications.Pulse ID: 67fd41f7af4b02a0fd75fb69 Pulse Link: <a href="https://otx.alienvault.com/pulse/67fd41f7af4b02a0fd75fb69" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://otx.alienvault.com/pulse/67fd41f7af4b02a0fd75fb69</a> Pulse Author: AlienVault Created: 2025-04-14 17:12:23Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/Atomic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Atomic</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/Office" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Office</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/PDF" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PDF</a> <a href="https://social.raytec.co/tags/RCE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RCE</a> <a href="https://social.raytec.co/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SupplyChain</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/cryptocurrency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptocurrency</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AlienVault</a>

securityaffairsMalicious <a href="https://infosec.exchange/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> packages target <a href="https://infosec.exchange/tags/PayPal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PayPal</a> users <a href="https://securityaffairs.com/176530/security/malicious-npm-packages-to-steal-paypal-credentials.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://securityaffairs.com/176530/security/malicious-npm-packages-to-steal-paypal-credentials.html</a> <a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#securityaffairs</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a>

Caycedo🎙️Creo que lo principal es no instalar el paquete de inmediato.Verificar el nombre en el repositorio que uses: <a href="https://oye.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://oye.social/tags/pypi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pypi</a> <a href="https://oye.social/tags/homebrew" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#homebrew</a> <a href="https://oye.social/tags/dotnet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dotnet</a> etc.Algunos paquetes en el repositorio pueden parecer confiables sin serlo. Revisaa las fechas de publicación y número de proyectos dependientes.Busca en otros foros sobre la funcionalidad que necesitas y valida qué recomienda la gente.En pocas palabras, busca el paquete por ti mismo, de la forma tradicional, sin confiar en tu <a href="https://oye.social/tags/LLM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LLM</a> "de confianza".

Caycedo🎙️<a href="https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/</a> Se ha identificado que los <a href="https://oye.social/tags/LLMs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LLMs</a> pueden generar nombres de paquetes falsos que usamos los desarrolladores, de forma consistente, debido a sus "alucinaciones". Así que personas inescrupulosas han creado y publicado estos paquetes en repositorios comunes como <a href="https://oye.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a>, <a href="https://oye.social/tags/pypi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pypi</a> y otros. Cuando un desarrollador usando un LLM ve esta referencia y descarga el paquete engañoso, puede introducir riesgos a sus sistemas difíciles de detectar.

Jamie TannaProperly patching packages: persistently producing patches for published projects, particularly practically prevented by patch-package policy How to use `patch-package` to modify NPM dependencies, for instance when you're distributing an executable and you want to patch something you rely upon, without relying upon `postinstall` scripts. <a href="https://fed.brid.gy/r/https://www.jvt.me/posts/2025/04/12/patch-package-distribute/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://fed.brid.gy/r/https://www.jvt.me/posts/2025/04/12/patch-package-distribute/</a>

Mike McCaffreyFYI: Absolutely do not use AI to generate any files that specify what packages to include in your project: <a href="https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/</a><a href="https://drupal.community/tags/GenerativeAI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GenerativeAI</a> <a href="https://drupal.community/tags/VibeCoding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VibeCoding</a> <a href="https://drupal.community/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://drupal.community/tags/Drupal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Drupal</a>

skry“slopsquatting, a new term for a surprisingly effective type of software supply chain attack that emerges when LLMs “hallucinate” package names that don’t actually exist. If you’ve ever seen an AI recommend a package and thought, “Wait, is that real?”—you’ve already encountered the foundation of the problem.And now attackers are catching on.”The Rise of Slopsquatting: How <a href="https://mastodon.social/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a> Hallucinations Are Fueling... <a href="https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks</a> <a href="https://mastodon.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://mastodon.social/tags/dev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dev</a> <a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>Edit: more info: <a href="https://www.bleepingcomputer.com/news/security/ai-hallucinated-code-dependencies-become-new-supply-chain-risk/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/ai-hallucinated-code-dependencies-become-new-supply-chain-risk/</a>

Pyrzout :vm:npm Malware Targets Atomic and Exodus Wallets to Hijack Crypto Transfers <a href="https://hackread.com/npm-malware-atomic-exodus-wallets-hijack-crypto/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://hackread.com/npm-malware-atomic-exodus-wallets-hijack-crypto/</a> <a href="https://social.skynetcloud.site/tags/Cryptocurrency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cryptocurrency</a> <a href="https://social.skynetcloud.site/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://social.skynetcloud.site/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberAttack</a> <a href="https://social.skynetcloud.site/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.skynetcloud.site/tags/Atomic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Atomic</a> <a href="https://social.skynetcloud.site/tags/Crypto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Crypto</a> <a href="https://social.skynetcloud.site/tags/Exodus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Exodus</a> <a href="https://social.skynetcloud.site/tags/Fraud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fraud</a> <a href="https://social.skynetcloud.site/tags/Scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Scam</a> <a href="https://social.skynetcloud.site/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a>

OTX BotMalicious NPM Packages Targeting PayPal UsersA series of malicious NPM packages have been identified deploying malware to steal sensitive information from compromised systems. It was observed that threat actor groups known as “tommyboy_h1” and “tommyboy_h2” were deploying these malware between March 5 and March 14 to targets PayPal users.Pulse ID: 67f951f94767a31bd6122975 Pulse Link: <a href="https://otx.alienvault.com/pulse/67f951f94767a31bd6122975" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://otx.alienvault.com/pulse/67f951f94767a31bd6122975</a> Pulse Author: cryptocti Created: 2025-04-11 17:31:37Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.raytec.co/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/cryptocti" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptocti</a>

Tom Boutell<a href="https://toot.cat/tags/hugops" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hugops</a> to <a href="https://toot.cat/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> today. Private package installs and "npm publish" are failing for older access tokens. You can clear the issue with a fresh "npm login". May need to update tokens in your CI systems for deployment as well. More on their status page. <a href="https://toot.cat/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#programming</a>

Pyrzout :vm:npm Malware Targets Atomic and Exodus Wallets to Hijack Crypto Transfers – Source:hackread.com <a href="https://ciso2ciso.com/npm-malware-targets-atomic-and-exodus-wallets-to-hijack-crypto-transfers-sourcehackread-com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ciso2ciso.com/npm-malware-targets-atomic-and-exodus-wallets-to-hijack-crypto-transfers-sourcehackread-com/</a> <a href="https://social.skynetcloud.site/tags/1CyberSecurityNewsPost" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#1CyberSecurityNewsPost</a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurityNews</a> <a href="https://social.skynetcloud.site/tags/Cryptocurrency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cryptocurrency</a> <a href="https://social.skynetcloud.site/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://social.skynetcloud.site/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberAttack</a> <a href="https://social.skynetcloud.site/tags/Hackread" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hackread</a> <a href="https://social.skynetcloud.site/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://social.skynetcloud.site/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://social.skynetcloud.site/tags/Atomic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Atomic</a> <a href="https://social.skynetcloud.site/tags/Crypto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Crypto</a> <a href="https://social.skynetcloud.site/tags/Exodus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Exodus</a> <a href="https://social.skynetcloud.site/tags/Fraud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fraud</a> <a href="https://social.skynetcloud.site/tags/Scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Scam</a> <a href="https://social.skynetcloud.site/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a>

Teddy / Domingo (🇨🇵/🇬🇧)<a href="https://framapiaf.org/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> Poisoned <a href="https://framapiaf.org/tags/Patches" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Patches</a> Infect Local <a href="https://framapiaf.org/tags/Software" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Software</a>. Malicious packages lurking on open source repositories like <a href="https://framapiaf.org/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> have become less effective, so cyberattackers are using a new strategy: offering "patches" for locally installed programs. <a href="https://www.darkreading.com/cloud-security/open-source-poisoned-patches-infect-local-software" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.darkreading.com/cloud-security/open-source-poisoned-patches-infect-local-software</a>

Hackread.com🚨 Watch out as new npm malware targets Atomic and Exodus wallets to alter their addresses and hijack crypto transfer.Read: <a href="https://hackread.com/npm-malware-atomic-exodus-wallets-hijack-crypto/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://hackread.com/npm-malware-atomic-exodus-wallets-hijack-crypto/</a><a href="https://mstdn.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mstdn.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://mstdn.social/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://mstdn.social/tags/Crypto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Crypto</a> <a href="https://mstdn.social/tags/Scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Scam</a>

OTX BotAtomic and Exodus crypto wallets targeted in malicious npm campaignThreat actors are employing new techniques to target the cryptocurrency community by uploading packages to popular open source repositories that apply malicious 'patches' to local versions of legitimate libraries. A recent campaign launched on April 1 published a package called 'pdf-to-office' on npm, which injected malicious code into locally installed Atomic Wallet and Exodus crypto wallet software. This attack overwrote existing files, allowing attackers to swap out intended wallet destination addresses with their own. The malicious package was designed to target specific versions of the wallets and included persistence mechanisms. This campaign is part of a larger trend of sophisticated software supply chain attacks targeting the cryptocurrency industry, highlighting the need for improved monitoring and security measures in both commercial and open-source software.Pulse ID: 67f80a491ab75c1a71050453 Pulse Link: <a href="https://otx.alienvault.com/pulse/67f80a491ab75c1a71050453" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://otx.alienvault.com/pulse/67f80a491ab75c1a71050453</a> Pulse Author: AlienVault Created: 2025-04-10 18:13:29Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/Atomic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Atomic</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/Office" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Office</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/PDF" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PDF</a> <a href="https://social.raytec.co/tags/RCE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RCE</a> <a href="https://social.raytec.co/tags/SMS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SMS</a> <a href="https://social.raytec.co/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SupplyChain</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/cryptocurrency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptocurrency</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AlienVault</a>

0x40kWhoa, the latest news is pretty wild! 🤯 Apparently, there's malware popping up in npm packages again, specifically designed to snatch crypto wallet credentials. Seriously, navigating the software supply chain feels like walking through a minefield sometimes.But hey, let's not hit the panic button just yet. It *is* a good reminder to be vigilant, though. First step? Definitely double-check your VS Code extensions – better safe than sorry, right?And keep this in mind: automated scans are certainly useful, a good first line of defense even. However, nothing really digs deep like a thorough pentest. That's where you uncover the stuff scanners might miss. It truly makes a difference.So, I'm curious – what are your go-to tools and strategies for embedding security right into your development workflow? Let's share some knowledge!<a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://infosec.exchange/tags/devsecops" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devsecops</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://infosec.exchange/tags/supplychainsecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#supplychainsecurity</a>

Olivier Stuker (he/him)npm: 3 moderate severity vulnerabilitiesme: npm audit fix --forcenpm: 5 moderate severity vulnerabilitiesAAAAAAAAAAAAAAAAAAAAA<a href="https://toot.community/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://toot.community/tags/nodejs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nodejs</a> <a href="https://toot.community/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#programming</a>

Recent searches

Search options

Administered by:

Server stats:

#npm