Malicious code in esqosintpostad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fd67fdcecea6eece9242bf6a69319c18541abd4aa2eadc780acfd630ac492466 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfgameencode (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9871a842dfbbc2dc38839cc0724b4f50b734a7ffe41bad67b98104125b8ce7c4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in postpush (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c1611df8d4579f55acb8455ca9c86695345bef179e1bd2548396fbcfee2188ee EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in adpaypal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c1266810cfbdd92dcfaf68be6940478cc59c38b37a18a8c3a80f65c056b8b055 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in toolcontrol (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6f2ed5210bef45da28bee8a78db28ba26f272913c79d15e0197df881d4f60713 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in postram (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx bb30a1aa3433b9e53c174f696a577da4857ca5989d9db2834800a3b1c35d0963 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links

In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links. "The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one...

Python Developers Beware: Clipper Malware Found in 450+ PyPI Packages!

Malicious actors have published more than 451 unique Python packages on the official Python Package Index PyPI repository in an attempt to infect developer systems with clipper malware. Software supply chain security company Phylum, which spotted the libraries, said the ongoing activity is a...

Malicious code in pyhton-binance (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx bb856715857f47e2c3e65e4207042488de6bfb22d3f55ee5762405004eea86a0 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in seleniumm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 96e73b8d4e768674f465eb608ffe826d16e12fe10dff319ca4502a911208368b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in vypre (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 94cfe97d788a08dba937df6a6dbd5b703b61e1027011f9ffa47f6112c48392ee Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

How to protect your business from supply chain attacks

Threat actors know that attacking the supply chain is not just a smart strategy but also a winning one. When American store Target found a Trojan designed to steal card details on its POS point-of-sale systems in 2013, no one expected that the route into its secure environment was its heating,...

Introducing Proactive API Leak Management

Read the press release announcing the early release of Wallarm API Leak Management The recent surge in hacks involving leaked API Keys and other API secrets such as credentials, passwords, certificates, tokens and encryption keys has put everyone involved on notice – organizations need a way to...

Improving Software Supply Chain Security

Explore use cases and mitigation strategies to improve software supply chain security and reduce cyber risk...

W4SP Stealer Discovered in Multiple PyPI Packages Under Various Names

Threat actors have published yet another round of malicious packages to Python Package Index PyPI with the goal of delivering information-stealing malware on compromised developer machines. Interestingly, while the malware goes by a variety of names like ANGEL Stealer, Celestial Stealer, Fade...

Researchers Discover Malicious PyPI Package Posing as SentinelOne SDK to Steal Data

Cybersecurity researchers have discovered a new malicious package on the Python Package Index PyPI repository that impersonates a software development kit SDK for SentinelOne, a major cybersecurity company, as part of a campaign dubbed SentinelSneak. The package, named SentinelOne and now taken...

Hackers Bombard Open Source Repositories with Over 144,000 Malicious Packages

NuGet, PyPi, and npm ecosystems are the target of a new campaign that has resulted in over 144,000 packages being published by unknown threat actors. "The packages were part of a new attack vector, with attackers spamming the open source ecosystem with packages containing links to phishing...

Google Launches OSV-Scanner Tool to Identify Open Source Vulnerabilities

Google on Tuesday announced the open source availability of OSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various projects. The Go-based tool, powered by the Open Source Vulnerabilities OSV database, is designed to connect "a project's list of dependenci...

CISA, NSA, and ODNI Release Guidance for Customers on Securing the Software Supply Chain 

Today, CISA, the National Security Agency NSA, and the Office of the Director of National Intelligence ODNI, published the third of a three-part series on securing the software supply chain: Securing Software Supply Chain Series - Recommended Practices Guide for Customers. This publication follow...

QSC 2022: That’s a Wrap!

Over the years, the threat landscape has exploded, and bad actors have become increasingly sophisticated, making the demand for cloud security platforms - that save security teams time and increase efficiency - a must-have for every cyber arsenal. This was underscored last week at QSC 2022 Las...