This Week in Malware—Ongoing Dependency Confusion
4 minute read time
This week in malware, Sonatype's automated malware detection systems have spotted over four dozen dependency confusion candidates.
Read More...
This Week in Malware— Cryptominers Flood npm, PyPI, and More Dependency Confusion
2 minute read time
This week Sonatype discovered 200+ npm and PyPI packages that are cryptominers, with additional packages comprising dependency confusion PoCs.
Read More...
More Than 200 Cryptomining Packages Flood npm and PyPI Registry
5 minute read time
More than 200 malicious packages have flooded npm and PyPI registries to install cryptominers on Linux hosts.
Read More...
Wicked Good Development Episode 13: Hacks and Ax, July Edition
13 minute read time
Ax Sharma, a security researcher at Sonatype and tech journalist, joins Kadi and Omar for his monthly update on protestware and ransomware.
Read More...
StringJS Typosquat Deploys Discord Infostealer Obfuscated Five Times
4 minute read time
An npm package called 'stringjs_lib' identified by Sonatype this week typosquats the popular npm library 'string' (or StringJS) to ship an obfuscated info-stealer obfuscated not one, five times.
Read More...
This Week in Malware—John Deere Dependency Confusion Attempt and More
3 minute read time
We discovered and analyzed 17 packages, at least a dozen of which were dependency confusion PoCs directly targeting the agricultural equipment giant John Deere (Deere & Company). An additional 42
Read More...
John Deere Dependency Confusion Attempt Flagged by Sonatype
4 minute read time
Sonatype identified 17 npm packages, at least 12 of which directly target John Deere's private npm dependencies via dependency confusion, a technique that continues to repeatedly be employed by bug
Read More...
This Week in Malware—July 15th Edition
2 minute read time
This Week in Malware we identified over 34 npm and PyPI packages that are either dependency confusion candidates, prank packages, contain PoC reverse shell code, or otherwise contain extensive
Read More...
This Week in Malware—Python Cryptominers, 345 Dependency Confusion Packages
17 minute read time
This week's highlights include a PyPI typosquat that drops a cryptominer and AWS credential stealer, along with an influx of 345 dependency confusion packages caught by Sonatype's automated malware
Read More...