Ossprey Security has obtained and analysed a full sample of the newly released Miasma Open Source Release.
Read our full technical analysis here.
https://t.co/WoyDKdHNDW
Find out more about how Ossprey Security can help protect you against source malware at https://t.co/sOBP1QplzG
@EMcD Full analysis, and remediation steps coming soon.
To protect yourself from emergent threats, even those we're not tracking yet, visit https://t.co/HmNSnltT0f
Ossprey Security is currently tracking an emergent Shai-Hulud wave affecting NPM packages scoped as redhat-cloud-services.
More information, along with detection & remediation steps coming soon.
We're tracking "Megalodon"
An active supply chain attack injecting malicious steps into GitHub Actions workflows at scale.
575K+ files stolen. 449 GB exfiltrated. Still ongoing.
If you see 'Optimize-Build' in CI, rotate every secret immediately.
https://t.co/9HTJT7ITfD
Ossprey Security flagged three malicious durabletask versions within seconds of each upload to PyPI this morning.
Same behaviour to yesterday's antv package compromise.
Our analysis, IOCs, and remediation advice.
https://t.co/L2UR5he7Hc
Ossprey Security detected nine antv npm packages this morning, each carrying an identical credential stealer that runs the moment you npm install and walks off with AWS, GitHub, npm, and Vault tokens.
https://t.co/s4wLPt4tBQ
@karpathy Another TeamPCP hit today with the malicious Telnyx pypi packages.
Yet another in an endless stream of supply chain compromises in packages.
https://t.co/d195ZsIPJm
A new wave of #TeamPCP malware embedded in #telnyx versions 4.87.1 and 4.87.2 on #PyPI. Full analysis is on our blog. If telnyx is in your dependency tree, check your installed version now.
https://t.co/d195ZsIPJm
#SupplyChainSecurity#PyPI#OpenSource
New Blog: Nx Package Compromise
Malware hidden in recent Nx releases created a repo called s1ngularity-repository in developers’ GitHub accounts exposing SSH keys, API tokens, and even wallet files.
Read the breakdown: https://t.co/eAkrvnGCER
#SupplyChainSecurity#npm#OSS
New from Ossprey: PyPI is cracking down on domain resurrection attacks by invalidating expired maintainer domains.
1,800 accounts un-verified in just 2 months.
Time to check if your dependencies rely on revoked maintainers.
Full blog:
https://t.co/bj6xtcclSG
#OpenSource
Now at #OSSummit, @bagder is absolutely rocking the stage. The room is laughing hard from all his examples of the life of an open source maintainer. But really, we should all be crying.
Example: 47 car brands rely on cURL. Not one contributes back the project.
#OSSummit#OSSEU
What a start to #OSSummit Europe! 🎉 Inspiring talks, buzzing sessions, and endless hallway conversations showed the power of the #OpenSource community in action. The energy is unmatched — and it’s only Day 1!
#OSSummit and #OpenSSFCommunity Day Europe are almost here. What’s on your “don’t miss” list?
Visit the #OpenSSF booth B33 for demos, AMAs, and practical insights from the people building secure-by-design tools for open source.
Read the highlights: https://t.co/2UtqVHapeB
🚨 North Korea infiltrated 100+ U.S. companies using fake remote workers—stealing data, crypto & defense tech.
They even used AI to forge voices, documents & LinkedIn profiles.
The worst part? Some were praised as top talent.
Full story → https://t.co/VFEPNQHkIh
Cryptocurrency company Binance has issued guidance on its blog for how to mitigate threats to personnel following a recent increase in actions targeting high profile individuals in the sector
https://t.co/nqUaClKlus?
See our latest blog post for a technical deep dive into what happened and what it means for engineers and defenders.
👉 https://t.co/3ujbFVuOCJ
Let us know your thoughts or what your team is doing to reduce this kind of risk.
#supplychainsecurity#BirdsOfCyber
Happy to announce that we have graduated from the Plexal Grow Cyber Security Accelerator! With over 60 sessions and countless insights, you can learn more about our experience with Plexal here: https://t.co/02e1Y7WZ5m
#SupplyChainSecurity#OpenSourceSecurity#CyberSecurity