NPM supply chain attack uses Ethereum blockchain

Photo of a chain illustrating the discovery of a malware campaign that takes advantage of the npm packages ecosystem for a software supply chain attack and uses the Ethereum blockchain for resilience against cyber security detection and mitigation strategies.

Checkmarx researchers have detected a unique supply chain attack within the NPM ecosystem that uses the Ethereum blockchain.

The malicious package, dubbed "jest-fet-mock," targets developers with a multi-platform malware employing Ethereum smart contracts for command-and-control (C2) operations. This marks a convergence of blockchain technology with traditional attack vectors—a method not yet observed in NPM packages. 

Attack mechanics and distribution

The...

4 November 2024 | Blockchain

EMERALDWHALE exploits vulnerable Git configuration files

A whale made of emerald illustrating the discovery of the EMERALDWHALE campaign by cyber security researchers that exploits Git configuration files and has leaked over 15,000 credentials.

Sysdig’s Threat Research Team (TRT) has uncovered a global operation known as EMERALDWHALE, which has stolen over 15,000 cloud service credentials by exploiting exposed Git configuration files.

EMERALDWHALE utilised multiple private tools to exploit several misconfigured web services, resulting in the theft of credentials from more than 10,000 private repositories.

Though the operation's primary targets appeared to be cloud service and email providers, the ultimate aim...

1 November 2024 | Developer

Zscaler highlights security trends challenging developers

Pile of keys illustrating the security trends and challenges posed to developers highlighted in Zscaler ThreatLabz's latest cybersecurity report for 2024.

Zscaler has released its annual ThreatLabz report, highlighting security challenges that should be on every developer's radar.

The 2024 Mobile, IoT, and OT Threat Report – covering June 2023 to May 2024 – highlights critical vulnerabilities in mobile applications, IoT devices, and operational technology (OT) systems that demand immediate attention from the development community.

One of the most alarming findings is the discovery of over 200 infected applications in...

15 October 2024 | Android

Entry points threaten multiple open-source ecosystems

Sign illustrating how vulnerabilities with entry points can be exploited by hackers to threaten open-source packages of multiple programming ecosystems.

While current tools have improved at detecting common tactics for exploiting open-source packages, a feature remains largely overlooked: entry points.

Security researchers at Checkmarx uncovered how attackers can leverage entry points across multiple programming ecosystems, with a particular focus on PyPI, to trick victims into running malicious code. This method – while not allowing for immediate system compromise – offers a subtler approach for patient attackers to...

14 October 2024 | Developer

GitLab releases critical security patches amid vulnerability streak

Person applying a band aid illustrating DevOps platform GitLab issuing new critical security patches following a streak of vulnerabilities that could impact organisations and software developers.

GitLab has released a new round of critical security patches for its Community Edition (CE) and Enterprise Edition (EE) products. The company strongly recommends that all self-managed GitLab installations be upgraded immediately to one of the latest versions: 17.4.2, 17.3.5, or 17.2.9.

These patch releases address several critical and high-severity vulnerabilities, including a critical flaw that could allow attackers to run pipelines on arbitrary branches. This latest security...

11 October 2024 | Developer

North Korean hackers target developers with fake job interviews

Software developer in a fake job interview orchestrated by hackers.

Cybersecurity researchers at ReversingLabs have uncovered malicious software packages linked to a campaign known as VMConnect, believed to be orchestrated by the North Korean hacking team Lazarus Group. The campaign, first identified in August 2023, uses fake job interviews to lure developers into downloading and executing malicious code.

The latest samples were traced to GitHub projects associated with previous targeted attacks. Researchers were able to identify one compromised...

11 September 2024 | Developer

Roblox developers targeted by year-long malware campaign

A sustained malware campaign targeting Roblox developers through malicious npm packages has been uncovered by Checkmarx security researchers. The attackers are impersonating the popular “noblox.js” library, publishing dozens of packages designed to steal sensitive information and compromise systems.

The campaign, which has been active for over a year, exploits trust in the open-source ecosystem. It particularly targets the Roblox platform, a lucrative target due to its massive...

2 September 2024 | Development Tools

North Korean hackers target developers in latest npm attack wave

A fresh offensive by suspected North Korean hacking groups has targeted the open-source software community with a series of malicious packages uploaded to the npm repository.

Identified by cybersecurity firm Phylum, the attacks leverage multiple techniques and appear designed to steal cryptocurrency and sensitive data from unsuspecting developers.

The campaign began on 12th August and involves several distinct publication patterns and attack types, suggesting the...

29 August 2024 | Developer

Unit 42 researchers uncover critical GitHub Actions vulnerability

A new attack vector that could compromise GitHub repositories has been uncovered by researchers at Palo Alto Networks' Unit 42 team. The vulnerability, which exploits GitHub Actions artifacts generated during CI/CD workflows, could potentially grant high-level access to cloud environments.

The researchers found that a combination of misconfigurations and security flaws can cause artifacts to leak tokens, including those for third-party cloud services and GitHub itself. These...

15 August 2024 | Developer

Veracode unveils tools to combat growing security debt

To help organisations tackle mounting security debt and an expanding attack surface, Veracode has announced two new platform innovations.

Veracode has introduced Universal Connector and Application Security Heatmap, both powered by Longbow, to enable businesses to quickly identify and prioritise security risks across their applications.

These new capabilities come at a critical time, as organisations struggle to manage an overwhelming volume of security alerts and the...

1 August 2024 | Hacking & Security