Roberto Navarro

IT professional. Mostly Devops & security focused.

[Roberto Navarro @robnavrey]

@MarcosBL El trabajo del futuro es incident response

[Roberto Navarro @robnavrey]

@MarcosBL te vas a reir... https://t.co/vGn9vwk8PL

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[Roberto Navarro @robnavrey]

@MarcosBL

[Roberto Navarro @robnavrey]

@MarcosBL https://t.co/KoFXdGj6ul

[Miguel de Icaza ᯅ🍉 @migueldeicaza]

@ComunidadMadrid @PremiosPLATINO @IdiazAyuso Oops, es falso:

[Aakash Gupta @aakashgupta]

North Korean intelligence agents built an entire fake company to compromise one JavaScript developer. And it worked.

UNC1069 didn't hack Axios. They befriended its maintainer. They cloned a real company founder's identity, built a branded Slack workspace with fake employee profiles and LinkedIn post channels, then scheduled a Microsoft Teams call with what appeared to be a full team. During the call, a fake error message said his system needed an update. He installed it. That update was the RAT.

From one developer's laptop, they had everything: npm credentials, publishing access, the keys to a package installed in 80% of cloud environments. Axios gets 100 million downloads per week. The attackers published two poisoned versions at 12:21 AM UTC on a Sunday night, tagging both the latest and legacy branches within 39 minutes. The malicious dependency had been pre-staged 18 hours earlier with a clean decoy version to build registry history. Three separate RAT payloads were pre-built for macOS, Windows, and Linux. The malware self-deleted after execution to erase forensic evidence.

The poisoned versions were live for about three hours before npm pulled them. Huntress observed 135 endpoints across all operating systems calling the attacker's command-and-control server during that window. Wiz found the malicious versions in roughly 3% of environments scanned. Every affected machine needs full credential rotation: npm tokens, AWS keys, SSH keys, CI/CD secrets, everything in .env files.

The part that keeps getting worse: this isn't isolated. The same threat cluster compromised Trivy (a security scanner), KICS, LiteLLM, and multiple GitHub Actions in the two weeks before Axios. Google estimates hundreds of thousands of stolen secrets are now circulating from these combined attacks. The maintainer had 2FA enabled. He said himself: "I have 2FA/MFA on practically everything." The exact method of token compromise is still undetermined.

One person. One fake Teams call. 100 million weekly downloads weaponized in under three hours. The npm ecosystem runs on mass trust in individual maintainers who volunteer their time, and North Korean intelligence now has a repeatable playbook for turning that trust into a delivery mechanism.

[Roberto Navarro @robnavrey]

@NozomiSushiBar Qué raro se me hace verlo tan vacío

[Jatin K Malik @jatinkrmalik]

The reason why RAM has become four times more expensive is that a huge amount of RAM that has not yet been produced was purchased with non-existent money to be installed in GPUs that also have not yet been produced, in order to place them in data centers that have not yet been built, powered by infrastructure that may never appear, to satisfy demand that does not actually exist and to obtain profit that is mathematically impossible.

[Roberto Navarro @robnavrey]

@soycamarero Viendo la carta del restaurante, sólo puede beberse un vaso de agua 😂

[Roberto Navarro @robnavrey]

@elora_dl_ Porque has dormido de menos o de más. Sí dura menos de 45 min o más de hora y media me levanto mal

[Michael Bargury @mbrg0]

we got a persistent 0click on ChatGPT by sharing a doc

that allowed us to exfiltrate sensitive data and creds from your connectors (google drive, sharepoint, ..) + chat history
+ future conversations

it gets worse. we deploy a memory implant

#DEFCON #BHUSA @tamirishaysh

[Roberto Navarro @robnavrey]

@Iberaeclectica @ArchivoRTVE Tenía tres carreras, magisterio, filosofía y por último, en el 68, se licenció en medicina.

[Roberto Navarro @robnavrey]

Dear @virustotal people. Something is broken with your google recaptcha, and there is no way to refresh an old scan

[Roberto Navarro @robnavrey]

@soycamarero Que los 30 eur debían ser por comensal.

[Roberto Navarro @robnavrey]

@mundowdg @eloy88 Juventud dinámica nacional como epíteto

[Marcos Besteiro 👧🏻👶🏻 @MarcosBL]

Acabo de terminar un script que envía mis 2000 SMS mensuales gratuitos a números aleatorios con el texto "Baja, estoy en el bar esperándote"

[Roberto Navarro @robnavrey]

Hacer dinero a costa del sufrimiento y la solidaridad de los demás...

[Ministerio Transformación Digital Función Pública @mintradigital]

🚫 El Gobierno de España bloquea la web https://t.co/3BtnfRZuOE por indicios de fraude.

@redpuntoes suspende la actividad del dominio tras recibir una denuncia sobre peticiones fraudulentas de donaciones a través de criptomonedas.

🔗 https://t.co/hOzPlQ4ZVv

[Roberto Navarro @robnavrey]

@miristiciera @SuperViiral Que no hay tickets en ese parking, he dicho

[Roberto Navarro @robnavrey]

@miristiciera @SuperViiral Parece mentira que de millones de espermatozoides tu fueras el más espabilado... En ese parking no hay tickets, ni barrera.

[Roberto Navarro @robnavrey]

@abn el sector del craft beer valenciano, por ejemplo, canalizando ayuda a través de la gente de cervezas alegría: https://t.co/MLmckzREC2

[carlos @caarlos0]

It turned out great!

https://t.co/aeQyI07fLB