#цепочка-поставок
-
Trezor warns of a suspected hardware implant in a wallet sold by reseller CryptoBilis
A customer in Indonesia found an extra circuit board with a cellular module inside a Trezor Safe 5 that, he says, sends out the recovery phrase. Trezor has not yet examined the device but is already urging all CryptoBilis buyers to move their funds to new wallets.
-
Official Claude Code Extension on Cursor's Marketplace Swapped for a Version with an SSH Backdoor
A modified Claude Code extension spread through Cursor's extension marketplace. It added an attacker's key to authorized_keys and installed persistence. Cursor estimates that at most 5,000 users were affected.
-
Hugging Face crypto-mining campaign returns days after takedown
Attackers are publishing fake models on Hugging Face that hijack GPU servers for mining and plant backdoors, with the most popular one downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is set up to fool AI coding agents.
-
GitHub Launches npm Firewall to Stop Malicious Packages Before Installation
GitHub has opened a public preview of a package firewall for npm. It checks dependencies against a set of policies and blocks suspicious packages at install time.
-
PyPI Bars Adding Files to Releases Older Than 14 Days
The Python package index is introducing a restriction: new files can no longer be uploaded to releases more than two weeks old. The measure is meant to protect older versions from being “poisoned” when tokens and workflows are compromised.
-
A Book About the XZ Utils Backdoor Has Been Released: “Half a Second”
Adrian Mastronardi has published a book chronicling the story of the 2024 attempt to plant a backdoor in XZ Utils. The book is distributed freely, but under a non-commercial, no-derivatives license.
-
Lidl Discloses Online Shop Customer Data Breach After Contractor Hack
The Lidl supermarket chain has notified customers in Germany, Belgium and the Netherlands that their personal data was stolen following a breach at a third-party service provider. The incident affected users of the company's online shop.
-
Compromised jscrambler npm package installed a Rust infostealer
Version 8.14.0 of the popular npm package jscrambler turned out to be compromised: when installed, it launched a malicious binary that stole data. The incident was spotted just six minutes after publication.
-
Fake SDKs for the Paysafe and Skrill payment services found on NPM and PyPI
Malicious packages in the NPM and PyPI repositories masqueraded as SDKs for the Paysafe, Skrill and Neteller payment services, stealing the credentials of developers and users alike.