Tag: malware

Malware Announcements Engineering Security Open Source AI SCA Compliance & SBOM Technology CI/CD

Malware

DarkGPT: Malicious Visual Studio Code Extension Targeting Developers

Malicious extensions are lurking in the Visual Studio Code marketplace. In this case, we discover and analyze DarkGPT, a Visual Studio Code extension that exploits DLL hijacking to load malicious...

Malware

Malicious npm Packages Impersonating Hyatt Internal Dependencies

Three malicious npm packages disguised as Hyatt internal dependencies were discovered using install hooks to execute malicious payloads. All packages share identical attack patterns and...

Shai-Hulud Supply Chain Attack Incident Response

The Shai-Hulud supply chain attack is a major incident targeting developers through malicious packages in the npm ecosystem. This post outlines the incident response steps that can be taken to...

Malware

Shai-Hulud 2.0 npm Supply Chain Attack Technical Analysis

Critical npm supply chain attack compromises zapier-sdk, @asyncapi, posthog, and @postman packages with self-replicating malware. Technical analysis reveals credential harvesting, GitHub Actions...

Ship Code. Not Malware. SafeDep Launches GitHub App for Malicious Package Protection

SafeDep launches a GitHub App for zero-configuration protection against malicious open source packages. Instantly scan pull requests and keep your code repositories safe from supply chain attacks.

Malware

npm Supply Chain Attack Exposes Private Repositories, AWS Credentials and More

npm supply chain attacks continue. This time targeting @ctrl/tinycolor and multiple other packages with credential stealer malware. In this blog, we will analyze the attack and its impact on the npm...