#Malware

AUR Supply Chain Attack Delivers eBPF Rootkit and Infostealer

A spoofed maintainer adopted over 400 Arch User Repository packages, injecting preinstall scripts that fetch malicious NPM payloads.

News · 2d ago0

Inside 'The Gentlemen' Ransomware: TTPs, AI, and Network Hardening

Understand the technical tactics of this rapidly expanding RaaS group to defend your edge devices and Active Directory.

Article · 2d ago2

Microsoft Pulls Dozens of GitHub Repos After Supply-Chain Malware Targets AI Coders' Credentials

Hackers slipped password-stealing code into Microsoft open-source projects tied to Azure and AI coding workflows. Here's the attack vector — and what to audit in your own pipeline.

News · 5d ago5

Miasma Worm Hits Microsoft Packages Twice in Weeks — and Your SLSA Provenance Won't Save You

The Miasma credential stealer has now compromised the same Microsoft GitHub account twice, defeating cryptographic supply-chain guarantees and triggering silently when developers open packages in AI coding agents.

Article · 5d ago1

uv Gets Built-In Vulnerability and Malware Scanning

Astral's uv package manager adds `uv audit` and optional install-time malware checks powered by OSV, closing supply-chain gaps that separate tooling can't easily address.

News · 6d ago1

Config Files That Run Code: The Supply Chain Blind Spot Nobody Is Auditing

The Miasma worm didn't need a malicious dependency. It used .claude/settings.json, .vscode/tasks.json, and package.json to detonate a credential stealer — before you read a single line of code.

Article · 6d ago0

Config Files That Run Code: The Supply Chain Blindspot You're Probably Not Auditing

The Miasma worm hid a credential-stealing dropper inside ordinary config files for VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, and Bundler. Here's exactly how each vector works — and what to review before you clone.

Article · 6d ago0