Results for “"malicious package"”
11–20 of 145 articles
Best match · title matches first
Dark Reading
4 years ago
Anatomy of a Malicious Package Attack
Malicious packages are hard to avoid and hard to detect — unless you know what to look for.
ransomware hospital — both words
"data breach" — exact phrase
malware -android — exclude a word
(apple OR microsoft) patch — either company, plus patch
ransom* — a wildcard match
Searches article titles, summaries, keywords and sources. Filters use publication dates.
11–20 of 145 articles
Best match · title matches first
Dark Reading
Malicious packages are hard to avoid and hard to detect — unless you know what to look for.
The Hacker News
NuGet, PyPi, and npm ecosystems are the target of a new campaign that has resulted in over 144,000 packages being published by unknown threat actors. "The packages were part of a new attack vector, with attackers spamming the open-source ecosystem with packages containing links to phishing campaigns," researchers from Checkmarx and Illustria said in a report published Wednesday. Of the 144,294
Check Point Research
Highlights: Check Point Research (CPR) detects a new and unique malicious package on PyPI, the leading package index used by developers for the Python programming language The new malicious package was designed to hide code in images and infect through open-source projects on Github CPR responsibly disclosed this information to PyPI, who removed the packages […]
Check Point Research
Highlights: Check Point Research (CPR) detects a new and unique malicious package on PyPI, the leading package index used by developers for the Python programming language The new malicious package was designed to hide code in images and infect through open-source projects on Github CPR responsibly disclosed this information to PyPI, who removed the packages... Click to Read More The post appeared first on . Check Point CloudGuard Spectral exposes new obfuscation techniques for malicious packages on PyPI Check Point Research
Check Point Research
Highlights: CloudGuard Spectral detects 10 malicious packages on PyPI, the leading Python package index used by developers for the Python programming language Malicious packages install info-stealers that enable attackers to steal developer’s private data and personal credentials Once detected, CPR disclosed the information and alerted PyPI on these packages. Later to be removed by PyPI... Click to Read More The post appeared first on . CloudGuard Spectral detects several malicious packages on PyPI – the official software repository for Python developers Check Point Research
ZDNet Security
The Google and OpenSSF Package Analysis project aims to reduce security risks created by developers' crazy package-updating schedules.
The Hacker News
The Open Source Security Foundation (OpenSSF) has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories. Called the Package Analysis project, the initiative aims to secure open-source packages by detecting and alerting users to any malicious behavior with the goal of bolstering the
Bleeping Computer
A logical flaw in the npm registry, dubbed 'package planting' let authors of malicious packages quietly add anyone and any number of users as 'maintainers' to their packages in an attempt to boost the trust in their package. [...]
Bleeping Computer
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
The Hacker News
Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices. "The injected code runs two operations against a site's visitors: a mobile ad-fraud and gambling-redirect