tomabai
Re:
on Wednesday April 23, 2025 @01:20PM (#43774417)
TLDR
You can easily make your NPM package look popular with a minimal script with no barriers at all.
Read the short story here - https://www.linkedin.com/posts/tom-abai-a4862915a_osssupplyc...
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware
on Wednesday February 12, 2025 @01:44AM (#43022565)
I get your point and agree with that, but i think that the technique used here was interesting
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware
on Wednesday February 12, 2025 @01:33AM (#43022515)
The package was published on npm, the original extension, has a private component on npm with a similar name to that package, and that the squat the attacker tried to take advantage of
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware
on Sunday February 09, 2025 @03:21AM (#42989314)
Nice, I also did in our website https://www.mend.io/blog/fake-vs-code-extension-on-npm-sprea...
Re:Fake VS Code Extension on NPM Spreads Multi-Stage Malware
on Friday February 07, 2025 @01:58AM (#42970170)
We discover a fake vscode extension that serves a multi-stage malware on npm, Inc.
The package uses javascript obfuscation for downloading the first stage of the malware, than it uses a heavily obfuscated batch file to conntinue into the second phase.
Lastly it leverages preconfigured ScreenConnect remote desktop installer to communicate with the compromised machine.
Re:A new platform for learning LLM's risks
on Monday January 27, 2025 @02:35AM (#42838370)
Hi guys, I'd like to introduce my new learning platform - LLM Security Labs.
This hands-on platform focused on the owasp top 10 for llm risks, where each risk has it own's lab in order to understand each risk with practical challenges, instead of just reading articles.
Hope you will enjoy that, would appreciate your feedback