Ossprey Security

Stop Malicious Code. Not Engineers.

AI-powered detection of malicious open-source packages in package manages such as npm and PyPI.

[Ossprey Security @osspreysecurity]

Ossprey Security has obtained and analysed a full sample of the newly released Miasma Open Source Release.

Read our full technical analysis here.
https://t.co/WoyDKdHNDW

Find out more about how Ossprey Security can help protect you against source malware at https://t.co/sOBP1QplzG

[Ossprey Security @osspreysecurity]

@EMcD Full analysis, and remediation steps coming soon.

To protect yourself from emergent threats, even those we're not tracking yet, visit https://t.co/HmNSnltT0f

[Ossprey Security @osspreysecurity]

We are currently tracking a resurgence in the moika[.]tech NPM malware campaign.
Below package list should be considered malicious.

@ccrm/[email protected]
@ccrm/[email protected]
@ccrm/[email protected]
@ccrm/[email protected]

[Ossprey Security @osspreysecurity]

@ccrm/[email protected]
@ccrm/[email protected]
@ccrm/[email protected]
@ccrm/[email protected]
@ccrm/[email protected]
@emcd-vue/[email protected]
@emcd-vue/[email protected]
@emcd-vue/[email protected]

[Ossprey Security @osspreysecurity]

Ossprey detected 32 redhat-cloud-services npm packages backdoored via a compromised developer account. Preinstall hook runs a credential worm: reads GitHub Actions secrets from /proc/mem, sweeps AWS/GCP/Azure/Vault/SSH, self-propagates via bypass_2fa.

https://t.co/Nkf23WvnY8

[Ossprey Security @osspreysecurity]

Ossprey Security is currently tracking an emergent Shai-Hulud wave affecting NPM packages scoped as redhat-cloud-services.

More information, along with detection & remediation steps coming soon.

[Ossprey Security @osspreysecurity]

We're tracking "Megalodon"
An active supply chain attack injecting malicious steps into GitHub Actions workflows at scale.

575K+ files stolen. 449 GB exfiltrated. Still ongoing.

If you see 'Optimize-Build' in CI, rotate every secret immediately.

https://t.co/9HTJT7ITfD

[Ossprey Security @osspreysecurity]

Ossprey Security flagged three malicious durabletask versions within seconds of each upload to PyPI this morning.
Same behaviour to yesterday's antv package compromise.

Our analysis, IOCs, and remediation advice.
https://t.co/L2UR5he7Hc

[Ossprey Security @osspreysecurity]

Ossprey Security detected nine antv npm packages this morning, each carrying an identical credential stealer that runs the moment you npm install and walks off with AWS, GitHub, npm, and Vault tokens.

https://t.co/s4wLPt4tBQ

[Ossprey Security @osspreysecurity]

@karpathy Another TeamPCP hit today with the malicious Telnyx pypi packages.

Yet another in an endless stream of supply chain compromises in packages.

https://t.co/d195ZsIPJm

[Ossprey Security @osspreysecurity]

A new wave of #TeamPCP malware embedded in #telnyx versions 4.87.1 and 4.87.2 on #PyPI. Full analysis is on our blog. If telnyx is in your dependency tree, check your installed version now.

https://t.co/d195ZsIPJm

#SupplyChainSecurity #PyPI #OpenSource

[Ossprey Security @osspreysecurity]

New Blog: Nx Package Compromise

Malware hidden in recent Nx releases created a repo called s1ngularity-repository in developers’ GitHub accounts exposing SSH keys, API tokens, and even wallet files.

Read the breakdown: https://t.co/eAkrvnGCER

#SupplyChainSecurity #npm #OSS

[Ossprey Security @osspreysecurity]

New from Ossprey: PyPI is cracking down on domain resurrection attacks by invalidating expired maintainer domains.

1,800 accounts un-verified in just 2 months.
Time to check if your dependencies rely on revoked maintainers.

Full blog:
https://t.co/bj6xtcclSG

#OpenSource

[Taco Verdo @TacoVerdo]

Now at #OSSummit, @bagder is absolutely rocking the stage. The room is laughing hard from all his examples of the life of an open source maintainer. But really, we should all be crying.

Example: 47 car brands rely on cURL. Not one contributes back the project.

#OSSummit #OSSEU

[The Linux Foundation @linuxfoundation]

What a start to #OSSummit Europe! 🎉 Inspiring talks, buzzing sessions, and endless hallway conversations showed the power of the #OpenSource community in action. The energy is unmatched — and it’s only Day 1!

[OpenSSF @openssf]

#OSSummit and #OpenSSFCommunity Day Europe are almost here. What’s on your “don’t miss” list?

Visit the #OpenSSF booth B33 for demos, AMAs, and practical insights from the people building secure-by-design tools for open source.

Read the highlights: https://t.co/2UtqVHapeB

[The Hacker News @TheHackersNews]

🚨 North Korea infiltrated 100+ U.S. companies using fake remote workers—stealing data, crypto & defense tech.

They even used AI to forge voices, documents & LinkedIn profiles.

The worst part? Some were praised as top talent.

Full story → https://t.co/VFEPNQHkIh

[Mike Evans @MikeEvansIntel]

Cryptocurrency company Binance has issued guidance on its blog for how to mitigate threats to personnel following a recent increase in actions targeting high profile individuals in the sector

https://t.co/nqUaClKlus?

[Ossprey Security @osspreysecurity]

See our latest blog post for a technical deep dive into what happened and what it means for engineers and defenders.

👉 https://t.co/3ujbFVuOCJ

Let us know your thoughts or what your team is doing to reduce this kind of risk.
#supplychainsecurity #BirdsOfCyber

[Ossprey Security @osspreysecurity]

Happy to announce that we have graduated from the Plexal Grow Cyber Security Accelerator! With over 60 sessions and countless insights, you can learn more about our experience with Plexal here: https://t.co/02e1Y7WZ5m
#SupplyChainSecurity #OpenSourceSecurity #CyberSecurity