‼️🚨 A new npm supply-chain attack compromised 57 packages across over 286 malicious versions in under 2 hours. The attackers used self-replicating malware, a new version of the Miasma worm, which also used evasion techniques to stay under the radar.
The payload targets CI/CD and developer credentials, including GitHub Actions secrets, cloud credentials, Vault tokens, SSH keys, npm and GitHub tokens, and password-manager stores. This variant also injects AI coding assistant config files at `.claude`, `.cursor`, `.gemini`, and `.vscode` paths, a separate persistence and repo-poisoning angle.
2.5M internet-computer:native MOVED AFTER MORE THAN FIVE YEARS OF DORMANCY
Five wallets funded directly by the minting protocol with 500k ICP each on May 6, 2021, transferred their entire balances to a wallet allegedly linked to @dfinity Foundation on June 2.
The 2.5M ICP had remained inactive for more than five years and is now consolidated into a single address. The source wallets are now empty.
‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs."
The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can.
Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept.
He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."
$ICP Liquidity on-chain improving ever more.
The evolution from 2024 is an interesting thing to watch.
Usually ecosystems get weaker over time.. look at how much on-chain liquidity improved over 2 years:
my instagram (@ korn) was stolen overnight via the Meta AI exploit and was subsequently disabled.
it was Meta Verified, facial scan verified, and had 0 TOS violations.
the account is the sole source of my income.
i spent 6 hours trying to get human support and meta's support AI gave me 4 broken links in a row. we're at the point where one AI stole it and another can't fix it, zero humans in the loop anywhere.
does anyone know how to get in contact with meta support about this?
it is absolutely ridiculous that a trillion dollar company allows an exploit like this and doesn't even address it.
@instagram@AIatMeta@DarkWebInformer
Telegram boasts over 700 million active users—not everyone is on Twitter. If you want to truly welcome new members into the $ICP ecosystem, @dfinity, you can’t ignore such a massive audience. Right now, your Telegram group is neglected, swamped by scammers, and leaves newcomers waiting months just to join. That’s no way to showcase what ICP can offer!
Here’s how to fix it:
• Remove manual approvals (like 99.99% of Telegram communities do).
• Add a proven anti-spam bot (e.g., Rosebot or Safeguard).
• Pin a clear guide explaining how to use @OpenChat or the Dfinity Forum.
Treat your Telegram space as a vital part of your global reputation. Show newcomers—and the broader crypto world—that $ICP takes growth, engagement, and user experience seriously.
Thank you