๐จ GitHub is investigating TeamPCPโs claim: ~4,000 internal repositories allegedly stolen and listed for sale ($50,000+).
This comes as the groupโs Mini Shai-Hulud worm just hit #Microsoftโs durabletask PyPI package (v1.4.1โ1.4.3) โ a #Linux-only infostealer that spreads via AWS SSM + Kubernetes.
Worth rotating secrets and scanning your repos.
Full story: https://t.co/m6iAHb1pXA
The Google Threat Intelligence Group has detected the first known instance of a threat actor using an AI-developed zero-day exploit in the wild. While the attackers planned a wide-scale strike, our proactive counter-discovery may have prevented that from happening. This finding is part of our new report on AI-powered threats.
๐จ Active supply chain attack on [email protected]. The latest version pulls in [email protected] -- a brand-new package that didn't exist before today.
Socket's AI analysis flags it as a malicious obfuscated dropper: runtime deobfuscation, dynamic execSync loading, payload staging to temp/ProgramData directories, and post-execution artifact deletion. Consistent with supply chain malware.
We're still investigating. If you use axios, pin your version and audit your lockfile.
OH MY GOD ITS HERE ๐ป๐ป๐ป
Want a copy of this book by @_Freakyclown_ ?
1. Comment
2. Share
3. Follow both me and @_Freakyclown_
Have your DMs open
You got 24 hours ๐ป