/
attack_type:account_takeover × latest_source_host:safedep.io × limpar

Resultados

2 casos · pág. 1/1

safedep.io · high

mrmustard 0.7.4 PyPI release trojanized via maintainer account takeover; steals SSH, AWS and Kubernetes credentials

A malicious version 0.7.4 of the mrmustard photonic quantum computing library (Xanadu) was published to PyPI on July 23, 2026, after the account of the project's lead maintainer (ziofil, Filippo Miatto) was compromised. Importing the package reads SSH private keys, AWS credentials and the Kubernetes config, then sends them to an attacker-…

research academia
safedep.io · critical

Compromised Rust crate arrayref 0.3.10 pulls typosquat proc-macro1, whose build script downloads and runs a remote binary

On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromis…

technology software development