This Week in Malware - Fileless Linux Cryptominer, 100 Packages

By Aaron Linskens on August 12, 2022 vulnerabilities

6 minute read time

This week Sonatype discovered more than 100 open source packages that were malicious, suspicious, or dependency confusion attacks.
Read More...

PyPI Package 'secretslib' Drops Fileless Linux Malware to Mine Monero

By Ax Sharma on August 11, 2022 vulnerabilities

7 minute read time

Sonatype identified a 'secretslib' PyPI package that covertly installs cryptominers on Linux systems.
Read More...

This Week in Malware—Typosquats in PyPI, dependency confusion packages

By Hernán Ortiz on August 04, 2022 vulnerabilities

2 minute read time

This Week in Malware we discovered 50 packages that are either malicious or dependency confusion attacks.
Read More...

Wicked Good Development Episode 13: Hacks and Ax, July Edition

By Kadi Grigg on August 03, 2022 npm

13 minute read time

Ax Sharma, a security researcher at Sonatype and tech journalist, joins Kadi and Omar for his monthly update on protestware and ransomware.
Read More...

Ransomware in PyPI: Sonatype Spots 'Requests' Typosquats

By Ax Sharma on August 02, 2022 vulnerabilities

8 minute read time

Sonatype has spotted multiple typosquats of the popular Python library, 'requests' that contain ransomware scripts.
Read More...

Open Source Licensing Shift: Fedora Blocks Creative Commons CC0

By Luke Mcbride on August 01, 2022 Nexus Lifecycle

6 minute read time

Recent news of a popular license no longer allowed in open source projects underlines the ongoing evolution of licenses and legal risk.
Read More...

StringJS Typosquat Deploys Discord Infostealer Obfuscated Five Times

By Ax Sharma on July 26, 2022 vulnerabilities

4 minute read time

An npm package called 'stringjs_lib' identified by Sonatype this week typosquats the popular npm library 'string' (or StringJS) to ship an obfuscated info-stealer obfuscated not one, five times.
Read More...

This Week in Malware—John Deere dependency confusion attempt and more

By Ax Sharma on July 22, 2022 vulnerabilities

3 minute read time

We discovered and analyzed 17 packages, at least a dozen of which were dependency confusion PoCs directly targeting the agricultural equipment giant John Deere (Deere & Company). An additional 42
Read More...

John Deere dependency confusion attempt flagged by Sonatype

By Ax Sharma on July 21, 2022 vulnerabilities

4 minute read time

Sonatype identified 17 npm packages, at least 12 of which directly target John Deere's private npm dependencies via dependency confusion, a technique that continues to repeatedly be employed by bug
Read More...