npm packages caught exfiltrating Kubernetes config, SSH keys
4 minute read time
Sonatype tracks an ongoing campaign that uses npm packages to retrieve and exfiltrate Kubernetes configuration and SSH keys to an external server
Read More...
New npm PoC packages target PayPal Zettle, Airbnb developers
4 minute read time
Sonatype identified npm packages that exploit dependency confusion, named after internal dependencies purportedly used by PayPal Zettle and Airbnb
Read More...
Malicious PyPI package ‘VMConnect’ imitates VMware vSphere connector module
3 minute read time
A malicious PyPI package ‘VMConnect’ designed to resemble VMware vSphere Connector Module was caught by Sonatype’s automated malware detection systems
Read More...
“Quoi...? feur” from meme to malware – PyPI package targets Windows with ‘NullRAT’ info-stealer
3 minute read time
A malicious PyPI package called ‘feur’ was caught by Sonatype’s automated malware detection systems
Read More...
npm manifest confusion – what is it and do you really need to worry about it?
Read More...
Sonatype's malicious open source and malware detection systems found hundreds of malicious PyPI packages.
Read More...
Last week's OpenAI payment data and chat history leak involved a Race Condition vulnerability in an open source component, Redis.
Read More...
Attacker floods PyPI with 1000s of malicious packages that drop Windows trojan via Dropbox
3 minute read time
A threat actor has infiltrated the PyPI software registry with 1,000s of malicious packages at one time.
Read More...
Malicious ‘aptX’ Python package drops Meterpreter shell, deletes ‘netstat’
4 minute read time
Sonatype identified malicious Python packages on the PyPI software registry that carried out multiple nefarious activities.
Read More...