eastside mccarty

Founder of OpenSourceMalware. Researcher, startup founder, Software Supply Chain Threat Intel

[eastside mccarty @eastsidemccarty]

@vortexau I’ve given up on MSRC/github/etc. itsca sinking ship

[eastside mccarty @eastsidemccarty]

Wanna gain some visibility into what bad guys might be targeting in your software supply chain? Use the free @ossmalware alerts feature, which will notify you if a malicious software component is targeting something you care about.

[eastside mccarty @eastsidemccarty]

DPRK is evolving quickly. In addition to changes you note while they are still using Vercel for c2, they are also using IPs behind https://t.co/7KeazO1uQ0 shorteners, as well as new surge of custom domains. Biggest change: they have pivoted to hiding payloads in pre-commit and post-checkout git hooks.

[eastside mccarty @eastsidemccarty]

Famous oxymorons:

[eastside mccarty @eastsidemccarty]

Link to announcement: https://t.co/QfyDHpedpZ

[eastside mccarty @eastsidemccarty]

Heya @airwallex, this is not a good look. Discriminating against people older than 25 is crazy and probably illegal. Do you follow this same practice in your hiring or procurement policies?

[eastside mccarty @eastsidemccarty]

@0xLupin @CharlieEriksen @adnanthekhan They are learning and evolving. They saw the success of DPRK use of VS Code tasks files and pivoted to that pretty quickly

[eastside mccarty @eastsidemccarty]

@vxunderground If the TA really exfil'd PII via a leaky API, then @Polymarket is at fault here. Guessing they are silently wrapping those endpoints with auth as we speak.

[eastside mccarty @eastsidemccarty]

@PolymarketDevs So, to clarify, the user PII and associated wallets were all meant to be public?

[eastside mccarty @eastsidemccarty]

This is crazy! @wiz_io researchers found that you could get remote code execution by sending a malicious payload via a git push command like this:
"git push -o <malicious-payload>"

Boom! That's it!

Like, I said CRAZY!

https://t.co/EVwy2H6ijr

[eastside mccarty @eastsidemccarty]

Dear @Lovable,
The recent changes you've made to your AI function UI are a disaster. The older way, where I could just hit Ctrl-J and edit inline, was simple, but it worked. The recent changes make things soooo much more complicated:
1. The sidebar on the right is disjointed from the inline experience. Am I editing the whole doc? Am I editing the highlighted section? I dunno! Fuck me, this is dumb.
2. When you perform AI edits, you don't get the simple "Accept inline" or "Insert below" options you used to get. Now, you get a non-intuitive "Show Changes" or a symbol that could be "return key" or "go back". I dunno which. When the user doesn't know how to accept edits, you know the UX has failed.

You have created an overly complex AI UX, and frankly, it feels like you just decided to ship stuff. You didn't really test these changes; you just yolo'd some complicated shit and ruined what was a simple, effective UI. And this is the problem with vibe-coding: the speed and ability to ship quickly lure people into thinking they NEED to push shit, when maybe, really, they shouldn't.

Maybe spend more time triaging your bug bounty program and overseeing your pull requests, and less yoloing UI changes?!

[eastside mccarty @eastsidemccarty]

Been caught up in the @vercel hack? If so, I created an incident response playbook to help you figure out what to do, and how to tell if you need to call somebody: https://t.co/6EbTMYGHpU

[eastside mccarty @eastsidemccarty]

@RTausique @OpenAI new?

[eastside mccarty @eastsidemccarty]

@mdowd @UnpromptedAU Booya!

[eastside mccarty @eastsidemccarty]

@VeloraDEX @Velora You need to unpublish version 9.4.1 of the NPM package, as it's still available for download. If you can't unpublish a specific version, you can unpublish the whole package, then republish with just version 9.4.2

[eastside mccarty @eastsidemccarty]

Bad guys now targeting @openclaw config files in their infostealers:

[eastside mccarty @eastsidemccarty]

@aakashgupta WTF. This is blatantly wrong.

Axios attack = UNC1069 = DPRK.

Litellm/trivy attack = TeamPCP = not DPRK.

This is where our society is: AI spewing shit snd kooks perpetuating it

[eastside mccarty @eastsidemccarty]

@adnanthekhan That was genuinely sad to read until i remembered clawdbot is just text prediction on steroids and it was just parroting HAL/Roy Batty quotes