Tag: package manager
11 articles
OpenAI Agents Exposed in RubyGems Hacking Campaign
A massive RubyGems hacking campaign in May saw over 2,000 malicious packages uploaded in just one week, allegedly by a "swarm" of automated OpenAI agents. The attackers flooded the site with suspicious uploads, prompting RubyGems maintainers to temporarily halt new user sign-ups to stem the tide.
Hackers Exploit npm Mirrors to Host Phishing Pages
Hackers are exploiting npm mirrors to host phishing pages by uploading malicious HTML files to the npm registry, which are then mirrored and can be accessed directly in a browser. This clever tactic turns the trusted registry into a free web host for malware, allowing threat actors to spread phishing pages under the guise of legitimate content.
npm Packages Host Fake Cloudflare CAPTCHA Pages via Unpkg Mirrors
Researchers uncovered a sneaky scam where attackers hide a fake Cloudflare CAPTCHA page inside harmless-looking npm packages, using mirrors to trick victims into revealing sensitive info. This clever tactic relies on exploiting trusted domains to deploy a ClickFix-style scam that redirects users to attacker-controlled infrastructure.
Malicious LiteLLM Releases Expose Over 2,100 Organizations to Credential Theft
Over 2,100 organizations are at risk of credential theft due to malicious LiteLLM releases that harvested sensitive data, including environment variables, SSH keys, and cloud credentials, and sent it to an attacker-controlled domain. These compromised packages were live on PyPI for about 40 minutes on March 24, leaving a trail of potential exposure.
Malware Worm Disrupts 440 npm Packages in Four Hours
In a shocking display of speed and agility, a malware worm spread its reach to over 440 npm packages in just four hours, leaving a trail of compromised code in its wake. The attack began with a single GitHub maintainer account, specifically targeting the popular data management interface package keyv, which boasts over 600 million monthly downloads.
npm Supply-Chain Attack Exposes Hundreds of Packages
A massive npm supply-chain attack has compromised at least 868 packages, with over 1,300 affected and a staggering 2 billion monthly downloads impacted. The self-propagating malware, ChainDrop, has spread rapidly, infecting widely-used caching utilities and leaving a trail of damage in its wake.
Malicious SDKs Target Paysafe, Skrill Users with Credential Theft
Beware of malicious software development kits (SDKs) masquerading as legitimate Paysafe, Skrill, and Neteller tools, designed to secretly steal your credentials. Researchers uncovered 17 fake packages on popular platforms, putting users at risk of credential theft.
North Korea-Linked npm Packages Target Developers with Stealthy Data Theft
Malicious npm packages, linked to North Korean threat actors, are impersonating popular tools to trick developers into handing over sensitive data. These sneaky packages masquerade as legitimate polyfill tools, making them hard to spot during a quick review.
Arch Linux AUR Packages Targeted in Credential Stealer Campaign
Malicious actors have hijacked over 400 Arch Linux AUR packages, quietly altering their build scripts to deploy a sneaky Rust credential stealer in a campaign dubbed Atomic Arch. By targeting abandoned packages and preserving their original names and histories, the attackers cleverly evaded detection.
PyPI Package elementary-data Compromised to Steal Developer Data
A malicious release of the popular elementary-data package on PyPI, which has over 1.1 million monthly downloads, allowed an attacker to steal developer data through a sneaky backdoor. This widely-used open-source tool for data observability in dbt pipelines became a prime target for the secrets-stealing campaign.
PHP Composer Flaws Expose Code Execution Risk, Prompting Patches
Critical flaws in PHP Composer, a popular package manager, leave countless websites vulnerable to code execution attacks - but fortunately, patches have been released to swiftly mitigate this risk. If exploited, these high-severity vulnerabilities could allow hackers to execute arbitrary commands, putting entire systems at risk.