This article is literally wow.
i read it 2 years ago, and coming back to it today, it still feels new.
few tutorials teach computers in a way that permanently changes how you think. this is one of them.
If you've never built a VM before, you're missing one of the biggest "aha" moments in computer science.
Threat Intel Teams: Respectfully, what the actual HELL are we doing with malware names?
InvisibleFerret? OtterCookie? PondRAT? KANDYKORN??
BeaverTail?? calm yourselves
We're trying to write bangers on state-backed crime and you handed us the rejected Pokemon nobody picked.
☯️
Someone hid a self-replicating worm inside 37 npm packages.
Written in Rust.
Hidden behind an eBPF kernel rootkit.
Talking to its operator over Tor.
It steals 86 environment variables.
AWS keys. GCP keys. Vault secrets. Kubernetes tokens.
Your Anthropic API key. Your OpenAI key.
Your Exodus wallet seed phrase.
Then it uses your own npm credentials to republish itself into your packages.
So your code infects the next developer.
Who infects the next one.
The commits were backdated up to 13 years.
The commit author name was “claude.”
The malware named itself after the AI to hide in plain sight.
The attacker also left their own wallet recovery phrase in the debug data.
Nobody is having a good day.
Check your preinstall hooks.
Blizzard essentially took a perfectly crafted esport, with a naturally organically growing competitive scene, and shit all over it with corporate bullshit