/
ttps_attack:T1021.004 × victim_sectors:"software development" × limpar

Resultados

2 casos · pág. 1/1

safedep.io · critical

DirtyBlanket npm packages impersonating Express and React drop self-spreading Linux worm with CHAOS RAT backdoor

The npm account dirtyblanket published nine typosquatted packages on September 29, 2026 in 33 minutes, eight copying Express and one copying React. On Linux, a preinstall hook fetches node.js through the Internet Archive Wayback Machine, which pulls the worm linux.sh from Codeberg and runs it with bash. The worm installs CHAOS, an open-so…

dirtyblanket hellscripter technology software development
safedep.io · high

testmetest npm packages carry Miasma-family worm with token-revocation wiper; operator testing in public

Between 19 and 22 October 2026, an operator published 15 npm packages whose names end in testmetest, carrying a Miasma-family self-propagating worm. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the victim's home directory when the stolen GitHub token is revoked. Safe…

software development technology