Looks like we have a live one here. Weird Rust maintainer phishing campaign using crates[.]ws:

https://discourse.ifin.network/t/bizarre-crates-io-phishing-campaign/232

🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week.

Multiple high-impact maintainers have all confirmed they were targeted in the same coordinated social engineering campaign that compromised Axios.

https://socket.dev/blog/attackers-hunting-high-impact-nodejs-maintainers

🚨 Active supply chain attack on [email protected]. The latest version pulls in [email protected] -- a brand-new package that didn't exist before today.

We're still investigating. If you use axios, pin your version and audit your lockfile.

https://socket.dev/blog/axios-npm-package-compromised

#Trivy got compromised on thursday and released a backdoored new version, which was rolled back. We spent the entire friday in incident response mode. Now they got compromised again over the weekend.

I have a lot of sympathy for people under pressure during an incident, but for fucks sake, having a security tool get compromised three times within two months is just completely bonkers. We spent more time remediating security issues caused by our security tooling than any other cause. And the fact that there wasn't any official communication on friday means that we had to rely on third-party writeups, which were missing critical information like exact docker container digests and time ranges of the compromise. This made incident response completely miserable.

Anyway. Trivy 0.69.4, 0.69.5, 0.69.6 were all compromised with infostealer malware. Do what you have to do. There are several decent writeups:
- https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release
- https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack
- https://labs.boostsecurity.io/articles/20-days-later-trivy-compromise-act-ii/

And Trivy has an advisory on their GitHub that covers last thursday, but not the second compromise over the weekend: https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23

#ThreatIntel #SupplyChain

First they ask for your date of birth,
but later they claim it's not enough.

Then they ask for your full name and location,
but later they claim it's not enough.

Then they ask for a copy of your passport,
but later they claim it's not enough.

Then they ask for your facial scan,
but later they claim it's not enough.

Then they ask for your fingerprints,
but later they claim it's not enough.

Then they ask for your palm scan,
but later they claim it's not enough.

Then they ask for a scan of your iris,
but later they claim it's not enough.

Then they ask for ...

#MassSurveillance #Authoritarianism #AgeVerification #Privacy #Democracy #HumanRights

Hello, I'm a woodcarver, and this is what I do ✌️

You can help me a lot by sharing my work, so people can buy or commission me sculptures.

Praying for octopus blessings on your life 🐙🙏

#art