/
data_types_exposed:system_information × latest_source_host:safedep.io × limpar

Resultados

2 casos · pág. 1/1

safedep.io · medium

Researcher squats 21 npm names matching bin entries of Google-scoped packages, using postinstall fingerprint beacons

On August 12, 2026, an npm user (rootdaddy-msrc, author field r00tdaddy) published 21 packages that squatted the unscoped CLI binary names declared in the bin field of Google-affiliated scoped packages, such as ngsw-config (from @angular/service-worker) and bazelisk (from @bazel/bazelisk). Scoped publishing, registry allowlists and lockfi…

r00tdaddy technology software development
safedep.io · high

mrmustard 0.7.4 PyPI release trojanized via maintainer account takeover; steals SSH, AWS and Kubernetes credentials

A malicious version 0.7.4 of the mrmustard photonic quantum computing library (Xanadu) was published to PyPI on July 23, 2026, after the account of the project's lead maintainer (ziofil, Filippo Miatto) was compromised. Importing the package reads SSH private keys, AWS credentials and the Kubernetes config, then sends them to an attacker-…

research academia