News and Notes from the makers of Nexus | Sonatype Blog

Ax Sharma

Ax is a Security Researcher at Sonatype and Engineer who holds a passion for perpetual learning. His works and expert analyses have frequently been featured by leading media outlets. Ax's expertise lies in security vulnerability research, reverse engineering, and software development. In his spare time, he loves exploiting vulnerabilities ethically and educating a wide range of audiences.

This Week in Malware—Malicious Rust crate, 'colors' typosquats

By Ax Sharma on May 14, 2022 vulnerabilities

6 minute read time

From a malcious Rust typosquat found in the crates[.]io repository to ongoing typosquatting attacks on 'colors' library, the OSS security problem hasn't gone away just yet.

Read More...

This Week in Malware—Apache Kafka typosquats, shorthand data exfiltration

By Ax Sharma on May 06, 2022 vulnerabilities

4 minute read time

This Week In Malware—May 6th edition: Apache Kafka typosquat, and a simple distraction technique.

Read More...

npm package downloads another package while exfiltrating your IP address and username

By Ax Sharma on May 06, 2022 vulnerabilities

5 minute read time

On any given day we analyze hundreds of suspicious npm and PyPI packages, but this one stood out to us. An npm package that downloads another empty npm package?

Read More...

Malicious npm 'colors' typosquats pack Discord malware

By Ax Sharma on May 03, 2022 vulnerabilities

5 minute read time

Sonatype has caught newer typosquats of the popular 'colors' npm library that contain Discord info-stealing malware.

Read More...

This Week in Malware—npm backdoors, bugs, 'mystery placeholders'

By Ax Sharma on April 29, 2022 vulnerabilities

6 minute read time

This Week in Malware we discuss malicious packages with backdoors and hidden Discord stealers, a serious npm bug that allowed for maintainer tampering, and hundreds of 'mystery placeholders' we are

Read More...

This Week in Malware—Malicious 'Distutil' and Spring4Shell active exploitation

By Ax Sharma on April 22, 2022 github

7 minute read time

A malicious 'Distutil' PyPI package, active Spring4Shell exploitation by attackers deploying cryptominers, An open source tool that enabled users to add Google Play to PCs, but secretly installed

Read More...

This Week in Malware - Special Edition on Protestware and a Struts RCE Deja Vu

By Ax Sharma on April 15, 2022 vulnerabilities

4 minute read time

In a special edition of This Week in Malware, we change focus and look at protestware and the tale of a two-year-old Struts bug that's returned.

Read More...

This week in malware—VMWare, secrets, and security by obscurity

By Ax Sharma on April 08, 2022 vulnerabilities

2 minute read time

This week in malware digest for 8th April 2022: VMWare dependency confusion attempt and the importance of secrets management.

Read More...

VMware VSphere dependency confusion attempt caught by Sonatype

By Ax Sharma on April 07, 2022 vulnerabilities

6 minute read time

Sonatype's automated malware detection bots flagged a suspicious dependency that has the same name as a real package used by VMware VSphere SDK developers.

Read More...

Previous Next

Software composition analysis

Container Security

CODE QUALITY ANALYSIS

Repository MANAGEMENT

Complete Platform

Book a Demo

For Professionals

For Industries

Content

CUSTOMER Portal

Integrations & Free Tools

About us

Contact Us

Sonatype Blog

Ax Sharma

This Week in Malware—Malicious Rust crate, 'colors' typosquats

This Week in Malware—Apache Kafka typosquats, shorthand data exfiltration

npm package downloads another package while exfiltrating your IP address and username

Malicious npm 'colors' typosquats pack Discord malware

This Week in Malware—npm backdoors, bugs, 'mystery placeholders'

This Week in Malware—Malicious 'Distutil' and Spring4Shell active exploitation

This Week in Malware - Special Edition on Protestware and a Struts RCE Deja Vu

This week in malware—VMWare, secrets, and security by obscurity

VMware VSphere dependency confusion attempt caught by Sonatype

Products

Free Tools

Solutions

Resources

Customer Portal

Company