BlueT - Matthew Lien

Head of Resilient Architecture, NICS & PDIS.
Travel and read 用靈魂和肉體，紀錄世界。
Geek, (Co)founder, CTO, Advisor, Entrepreneur, whatever.
#Linux #Security #OpenSource

[BlueT - Matthew Lien @BlueT]

@sciwork I can't attend but would love to support. Do you accept small donations to support this project? (maybe by adding one more ticket type without requiring to select food types, etc)

[Aakash Gupta @aakashgupta]

North Korean intelligence agents built an entire fake company to compromise one JavaScript developer. And it worked.

UNC1069 didn't hack Axios. They befriended its maintainer. They cloned a real company founder's identity, built a branded Slack workspace with fake employee profiles and LinkedIn post channels, then scheduled a Microsoft Teams call with what appeared to be a full team. During the call, a fake error message said his system needed an update. He installed it. That update was the RAT.

From one developer's laptop, they had everything: npm credentials, publishing access, the keys to a package installed in 80% of cloud environments. Axios gets 100 million downloads per week. The attackers published two poisoned versions at 12:21 AM UTC on a Sunday night, tagging both the latest and legacy branches within 39 minutes. The malicious dependency had been pre-staged 18 hours earlier with a clean decoy version to build registry history. Three separate RAT payloads were pre-built for macOS, Windows, and Linux. The malware self-deleted after execution to erase forensic evidence.

The poisoned versions were live for about three hours before npm pulled them. Huntress observed 135 endpoints across all operating systems calling the attacker's command-and-control server during that window. Wiz found the malicious versions in roughly 3% of environments scanned. Every affected machine needs full credential rotation: npm tokens, AWS keys, SSH keys, CI/CD secrets, everything in .env files.

The part that keeps getting worse: this isn't isolated. The same threat cluster compromised Trivy (a security scanner), KICS, LiteLLM, and multiple GitHub Actions in the two weeks before Axios. Google estimates hundreds of thousands of stolen secrets are now circulating from these combined attacks. The maintainer had 2FA enabled. He said himself: "I have 2FA/MFA on practically everything." The exact method of token compromise is still undetermined.

One person. One fake Teams call. 100 million weekly downloads weaponized in under three hours. The npm ecosystem runs on mass trust in individual maintainers who volunteer their time, and North Korean intelligence now has a repeatable playbook for turning that trust into a delivery mechanism.

[BlueT - Matthew Lien @BlueT]

這幾天建議大家先別安裝、更新 js 模組 😂
Axios 中招，這波影響應該誇張大...
作者帳號被盜，模組被更新成塞了惡意程式碼的版本...

[Feross @feross]

@SocketSecurity UPDATE in case you missed it earlier: This is bigger than initially reported. Both [email protected] AND [email protected] were compromised – the attacker poisoned the 1.x and 0.x branches within 39 minutes of each other, maximizing blast radius across projects using caret ranges.

[BlueT - Matthew Lien @BlueT]

@pofeng 身分證字號算 PII ，如 @Kirin_Lin 所說，通常用加密或雜湊、代碼的方式取代敏感資料

[pofeng @pofeng]

剛剛忘了附上鏈結 :

https://t.co/LuMGjsYHHA

[pofeng @pofeng]

跟著 au 前大臣的腳步，一人一 emoji，連署請 Hugging Face 提供 TAIDE-12b 的推論 API

[BlueT - Matthew Lien @BlueT]

@mrmoneyc 補個 Google Play link for Android :
https://t.co/Fa14tJYgF4

[UbuCon Asia | 8-9 Aug 2026 Taipei, Taiwan @UbuConAsia]

Check out our new #logo for this year's #UbuCon Asia 2026 @COSCUP! #FormosanBlackBear #UbuConAsia

[KK.aWSB @KKaWSB]

这位外国小哥教你如何判断来电者是否是AI诈骗‼️

只需问问他有没有纸杯蛋糕的食谱就行了！哈哈……

[Kritika @kritikakodes]

POV: You say 'I'm full-stack' thinking it's just React + Node.

[Lydia Hallie ✨ @lydiahallie]

Excited to announce Claude for Open Source ❤️

We're giving 6 months of free Claude Max 20x to open source maintainers and core contributors.

If you maintain a popular project or contribute across open source, please apply!

https://t.co/inuh0hxREA

[BlueT - Matthew Lien @BlueT]

It’s easier done than say.

[BlueT - Matthew Lien @BlueT]

@pofeng 我去年 10 月有接種 A 流疫苗，不巧仍中了 XD

[BlueT - Matthew Lien @BlueT]

@pofeng Interface is cheap, show me your PRD.
PRD is cheap, show me your prompt.

Prompt is cheap, show me your intent.

https://t.co/FAUG6iPu1k

[BlueT - Matthew Lien @BlueT]

"Code is just a lossy projection of intent"

[BlueT - Matthew Lien @BlueT]

https://t.co/B0H50xAnC6

[BlueT - Matthew Lien @BlueT]

"Code is just a lossy projection of intent"

[BlueT - Matthew Lien @BlueT]

@charl_dot_dev @paramaggarwal @CloudflareDev still waiting in the waitlist 🥲

[BlueT - Matthew Lien @BlueT]

@alexocheema @exolabs @awnihannun Just got some Mac Studios and gonna try it, can't wait to see the benchmark results!

[BlueT - Matthew Lien @BlueT]

Beautiful things from the lovely seeds.