Cybersecurity

8648 readers

113 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago

MODERATORS

kid@sh.itjust.works

Lanky_Pomegranate530@midwest.social

Sha1-Hulud Supply Chain Attack: 800+ npm Packages and Thousands of GitHub Repos Compromised (cybersecuritynews.com)

submitted 1 day ago by kid@sh.itjust.works to c/cybersecurity@sh.itjust.works

2 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] TragicNotCute@lemmy.world 7 points 1 day ago (1 children)

The most alarming evolution in this variant is its aggressive volatility. While the primary goal remains credential theft, the malware includes a destructive fail-safe that triggers if it cannot establish persistence or exfiltrate data.

Certainly as escalation compared to what you normally see in NPM attacks.

[–] thebardingreen@lemmy.starlightkel.xyz 5 points 1 day ago* (last edited 1 day ago)

The NPM ecosystem has been ripe for this kind of invasion over a decade. And I don't want to make generalizations or throw shade at a whole class of people, but over the years I have met a lot of very complacent, very naive about security Node devs (some of whom have gotten very frustrated with me for raising concerns about the ecosystem being a ticking time bomb).

I've been expecting something like this for years.