R3B00T

Software Engineer | Coffee Connoisseur | Tech Aficionado

[R3B00T @Ravenmight]

@PapaObserver @lauren_w67 Woke garbage.

[R3B00T @Ravenmight]

@H0LLYW00D29 @yert47022398 @JCFights No one does. lol Loud mouth is all.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you.

The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads.

The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate.

Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.

[R3B00T @Ravenmight]

Can we Make this happen? @github
#github #repo #fork

[Elon Musk @elonmusk]

I love giant machines

[R3B00T @Ravenmight]

@KaynakNews 19 gbs is pretty slow

[R3B00T @Ravenmight]

Hijacked? Sorry but I don't leave my credentials just lying around. Lets call it what it really is.
#axios #insidejob #squidprorow

[klöss @kloss_xyz]

do you understand what just happened to one of the most used npm packages on the internet?

→ axios gets downloaded over 100 million times a week and today it got compromised

→ an attacker hijacked the npm credentials of a lead axios maintainer… changed the account email to an anonymous ProtonMail address… and manually published two poisoned versions

→ [email protected] and [email protected]… neither version contains a single line of malicious code inside axios itself. instead they inject a fake dependency called plain-crypto-js that drops a remote access trojan on your machine

→ the fake dependency was staged 18 hours in advance… three separate payloads were pre-built for macOS, Windows, and Linux… both release branches were hit within 39 minutes. every trace was designed to self-destruct after execution too

→ there’s no tag in the axios GitHub repo for 1.14.1. it was published outside the normal release process entirely... bypassed CI/CD completely

→ StepSecurity called it one of the most operationally sophisticated supply chain attacks ever against a top 10 npm package

→ a routine npm install silently opens a backdoor… no warning… no suspicious code visible in axios itself

this is the wake up call all vibe coding bros need to hear right now:

→ if you installed either version… assume your system is compromised

→ pin to [email protected] or [email protected]

→ rotate all secrets, API keys, SSH keys, and credentials on affected machines

→ check network logs for C2 connections

→ add –ignore-scripts to CI npm installs going forward

100 million weekly downloads and one compromised maintainer account…

that’s all it took to wreak absolute havoc

and I imagine we see a whole lot more of these… crazy times ahead for cybersecurity and vibe coding

be safe out there y’all

[R3B00T @Ravenmight]

@maxedapps Good luck out there everyone. It’s looking pretty scary today.

[Wes Bos @wesbos]

‼️Do not npm install or deploy anything right now

Supply chain attack on axios 1.14.1 - even if you don’t use axios it may be a nested dep.

Pin versions or wait until this is resolved

[R3B00T @Ravenmight]

@VinnysCorner1 Warren moon!

[R3B00T @Ravenmight]

@travisakers Because he’s American.

[R3B00T @Ravenmight]

@AngelMD1103 He literally said the lease expired. Like 2 seconds in.

[R3B00T @Ravenmight]

@gethackteam Why so many at one Address?

[R3B00T @Ravenmight]

@DyerbolicalDB

[Elon Musk @elonmusk]

Prizes for best Grok Imagine videos!

[Elon Musk @elonmusk]

Can you Imagine?

[R3B00T @Ravenmight]

@Manuel_ivan27 @chargers Yes they did.

[R3B00T @Ravenmight]

@rasmalai F

[R3B00T @Ravenmight]

@cheetah Real fans don’t want you going anywhere @cheetah !!

[R3B00T @Ravenmight]

Linux is looking better and better.

[Matthew Green @matthew_d_green]

Microsoft is handing over Bitlocker keys to law enforcement. https://t.co/ag7UFf6uk4