» Tag
malware
27 postsReport Alleges Unisoc/Longcheer Supply Chain Compromise via System Apps
A forensic report claims signed system apps on Unisoc/Longcheer devices enable covert C2 tunnels and anti-forensic kernel panic attacks.
Rust crate arrayref 0.3.10 pulls in malware via proc-macro1 dependency
crates.io package arrayref 0.3.10 pulls in malicious proc-macro1, executing remote payloads and affecting Rust GUI projects like egui and iced.
Shai-Hulud npm Worm Infects Over 1,280 Packages
Shai-Hulud npm worm spread credential-stealing malware across over 1,280 packages.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comHow a hijacked npm preinstall hook delivered a silent infostealer
A hijacked npm package used a preinstall hook to drop a cross-platform Rust infostealer, exposing risks in unattended and AI-agent-driven installs.
ChainDrop worm crawls into npm supply chain, evades standard defenses
ChainDrop, a Shai-Hulud npm worm variant, infected 444 packages and spreads via tarballs, evading standard repository-based defenses.
Python Bytecode: The Security Blind Spot Beyond Source Review
Study of over 1M PyPI packages shows Python .pyc bytecode bypasses source-level security review, exposing CPython to crashes and memory-corruption bugs.
Malicious Rust Crate Arrayref Executes a Build-Time Payload
A compromised release of the arrayref crate runs a malicious payload at build time, raising security concerns for developers.
Malicious Sites Use JavaScript to Build Malware in Browser Memory
A malvertising campaign uses fake sites to have browsers assemble malware in memory.
OctLurk and SilkLurk Windows Backdoors Target Governments in 6 Countries
Kaspersky reveals OctLurk and SilkLurk backdoors targeting governments across six countries.
AsyncAPI Supply Chain Attack Delivers Miasma RAT via NPM
A supply chain attack on AsyncAPI has resulted in malicious npm packages delivering Miasma RAT. This incident reveals critical vulnerabilities.