Touche.

Ooooohh, this looks legit!

Another day, and another @hacker0x01.bsky.social "researcher" ganking people's AWS keys in a public NPM package (plugin-senna). 🤦‍♀️

Bug bounty peeps, yo

As an Australian, my heart hurts today.

We have a special episode of @absoluteappsec.bsky.social today with Paul McCarty @6mile.githax.com who will help us make sense of the last few weeks of npm news. So join Paul @sethlaw.bsky.social and @cktricky.bsky.social at 12 Noon ET here: www.youtube.com/watch?v=UM4F...

We knew it was coming, and now it's here: Dynamic payloads have been found in @npmjs.bsky.social packages. Ouch. 😦

Noice! I think this is the first time my work has been covered by @bleepingcomputer.com

I'm on @thehackernews.bsky.social again

I've identified a new worm affecting NPM. I'm calling it "IndonesianFoods" based on its internal dictionary. The intent is to generate assets on the Tea Protocol blockchain. It's dumb, but it's MASSIVE! Check the link 👉 sourcecodered.com/indonesianfo... @npmjs.bsky.social @github.com

I like the one-two combo you got going there picklerick

Don't let AI write your payloads for you if you don't know what you're doing. Otherwise, you might end up publishing your API keys, environment variables, and identity to @npmjs.bsky.social

Want to sniff out private bug bounty programs? If you monitor OSV for new malicious packages, you'll get some great intel. Today's example: @npmjs.bsky.social user Paastha published 6 packages targeting @vercel.com. But wait, they don't have a BB program?! Or do they.... 😮💥

Tell me that @v0.dev has a bug bounty program without telling me they have a bug bounty program. #dependencyconfusion #maliciouspackage

Heya homie, that ain't gonna work.

I need to talk to someone in the @reversinglabs.com detection team. Anyone in my network got an intro?

I gave a talk at the FIRST CTI conference in Berlin earlier this year. Here's my presentation in its entirety. www.youtube.com/live/j23OubE...

Impressed with the Tenable One CSPM demo at the #Tenable #BlackHat booth. Blends vulnerability scanning with cloud security + ASPM features via IaC scanning and Git integrations. Worth checking if you're comparing cloud security solutions: bit.ly/4mbhg3e #BlackHat2025 #CloudSec

See me at 11 am today on the #DEFCON Creator State 4 (room 228). I'm super excited for this, and a big "thank you!" to the #AdversaryVillage team! #hackersummercamp @github.com

AI has written its first malicious package! I found an NPM package named @kodane/patch-manager that deploys a well-written persistent JavaScript crypto drainer. Here's the thing: I'm pretty sure Claude wrote it! Check out my post: getsafety.com/blog-posts/t... @anthropic.com @npmjs.bsky.social

The apocalypse is upon us!

I'm the first presentation for Adversary Village at @defcon.bsky.social. See me talk about open-source malware at 11 am on Saturday, August 9, in room 228 (creator stage 4)

Heya @virginaustralia.bsky.social I just tried to buy tickets for $6903 as advertised, but turns out it's a bait & switch. Real price: $11,617. VA support blames it on "website latency" but that price still on site. Wonder what Australian ACCC will make of VA advertising fares that don't exist?

You can't make this shit up! The NIST NVD database has been down all day, so no one can look up CVEs via NVD. @shodanhq.bsky.social reports that one of the two ec2 instances serving up the NVD website reports a "402 Payment Required". Did DOGE dipshits break our national vulnerability database?!

New infostealer targets Exodus crypto wallets. The author wrote this malware in a little-known language to evade detection. Read my write-up here: sourcecodered.com/npm-package-...

I wrote a post about the 3 most common myths I run into when talking to developers or infosec teams about malicious packages. Devs aren't familiar with malicious packages & security teams assume that existing security tools will find malware (spoiler: they don't). sourcecodered.com/three-myths-...

I've identified an NPM package named "arcus-cmd-utils" that deploys a Chrome-based infostealer to infected computers. You can read my blog post complete with technical details and IOCs. @npmjs.bsky.social @github.com #softwaresupplychain #devsecops sourcecodered.com/malicious-ar...

My blog post is top spot on Hackernews! Woot! @hackernewsbot.bsky.social #softwaresupplychain

Quickest turnaround in MONTHS from NPM as they've taken down the marked-cs and marked-ps malicious packages in less than a day! Woot! @npmjs.bsky.social #softwaresupplychain #npm

Two malicious packages were published to the NPM registry named "marked-cs" & "marked-ps". They take advantage of naming inconsistencies in the popular marked-js library & deploy modified gh0strat implants when you install the malicious packages. @npmjs.bsky.social sourcecodered.com/npm-packages...

Guess who's gonna be presenting at the @first.org CTI conference on April 23rd in Berlin? That's right, me! Woot! We will discuss how enterprise organisations can add #softwaresupplychain #threatintel to their existing #CTI and #threathunting workflows. www.first.org/conference/f...

Spotted

Did a security researcher at Snyk really just publish malicious packages to NPM targeting Cursor.com?

If you are using crypto/web3 libraries be aware that many npm packages that claim to be a part of @solana.com or @walletconnect.bsky.social ecosystems are malicious. For example, the solanacore, walletcore-gen and solana-login @npmjs.bsky.social packages drop infostealers on hosts and exfil data.

Happy holidays from #badsanta!

Attackers compromised the popular rspack/core & rspack/cli NPM packages owned by @bytedance.bsky.social. The attackers published version 1.1.7 for both packages, which deployed the xmrig crypto miner & sent all tokens to the IP 80[.]78.28.72. These packages are downloaded thousands of times a week

Major Announcement Regarding the HOPE Conference: Effective immediately, HOPE will happen EVERY summer, not every two years. HOPE_16 will be August 15-17, 2025! www.2600.com/content/majo...

BREAKING NEWS! Six packages were just published to the NPM registry, delivering a new MacOS malware. Do not install these packages! #softwaresupplychain #malware @npmjs.bsky.social

Shodan is down!

Do you know what's behind your @gitlab.com /explore endpoint? cycode.com/blog/ai-powe...

Ouch.

A @npmjs.bsky.social package named discord-json-scaller was published on 12/7 & removed on 12/12. It contained an elegant Discord injection attack written by the same author of hackirby/skuld. It intercepts login, registration & 2FA requests, email & password changes, credit card payments & more.

Woot! My first three CFP/CFT submissions for 2025 have come back accepted! Stoked!

Is there a special @hacker0x01.bsky.social badge for this?

Big shout out to @sydseter.com and their starter pack posts. Makes moving to @bsky.app much easier. Cheers mate!

2025 is almost upon us, so I updated the APAC Cyber Conferences @github.com repo at github.com/Infosec-Comm...

#Ultralytics has been compromised again tonight. This is the second time in two days that bad guys have leveraged a nifty shell injection bug in Actions. Maybe it's time to stop using this library. I mean, fool me once, shame on you. Fool me twice, shame on me, right?