I work in Finance | Dev @yield_xyz | Ex @RenzoFinance @SUPRA_Labs Views are my own
Bengaluru, India
Joined October 2019
- Tweets676
- Following624
- Followers280
- Likes4.4K
anshulrai.eth retweeted
Really good time to consider putting your SSH Keys on a hardware security key, such as a Yubikey.
🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.io.
Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.
TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys.
Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.
Honestly, one of the easiest security upgrades you can make on macOS is installing @littlesnitch.
It shows you when apps are trying to connect out from your machine, and it’s honestly eye-opening how many apps quietly phone home in the background.
At the very least, do this on your main work device.
anshulrai.eth retweeted
Update 5:05 PT: The attack has now expanded well beyond @TanStack and @Mistral.
373 malicious package-version entries across 169 npm package names, including @uipath, @squawk, @tallyui, @beproduct, and more.
The malware propagates by stealing your CI credentials and using them to publish new compromised versions.
Full IOCs, affected package list, and detection steps: aikido.dev/blog/mini-shai-hu…
🚨 Update: @mistralai npm packages are now confirmed compromised as part of the ongoing Mini Shai Hulud attack.
Affected versions:
@mistralai/mistralai 2.2.2, 2.2.3, 2.2.4@mistralai/mistralai-azure 1.7.1, 1.7.2, 1.7.3@mistralai/mistralai-gcp 1.7.1, 1.7.2, 1.7.3If you use the Mistral SDK in any CI pipeline, treat your environment as compromised. Rotate npm tokens, GitHub PATs, and cloud credentials immediately.
anshulrai.eth retweeted
🚨 BREAKING: Socket and @Docker uncovered what appears to be a broader Checkmarx supply chain compromise affecting official KICS Docker images and recent Checkmarx VS Code extension releases.
We found malicious images in the official checkmarx/kics Docker Hub repo, including overwritten tags and a new tag outside the normal release flow.
Our analysis also found signs that recent Checkmarx extension releases introduced code capable of downloading and executing what appears to be a malicious remote addon.
We’re in touch with the Checkmarx team and still investigating the incident.
In the Goldilocks Zone of AI browsers:
Atlas does too little,
Comet does too much,
Dia lands just right.
Someone should create a @Polymarket for this
