/
ttps_attack:T1083 × victim_sectors:technology × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · high

Google Antigravity IDE browser extension flaw enables arbitrary file write and RCE via SaveScreenRecording path traversal ($10,000 bounty)

Hacktron researcher sudi disclosed a vulnerability in the browser extension bundled with Google's AI IDE Antigravity, which is built on the same internals as Windsurf. The extension's externallyconnectable setting allows any web page to send messages to it. The SaveScreenRecording action forwards attacker-controlled filename and L fields …

technology software development
safedep.io · high

Typosquat npm chain ioredis-xyz → redis-type-xyz → ulid-xyz delivers MicrosoftSystem64 RAT, linked to DPRK FAMOUS CHOLLIMA

SafeDep flagged the malicious npm package ulid-xyz in June 2026. It typosquats ulidx and is a cross-platform remote access trojan. It is delivered through a three-layer transitive dependency chain: ioredis-xyz (a clone of the legitimate ioredis client) depends on redis-type-xyz (an empty manifest posing as Redis OM), which in version 1.10…

FAMOUS CHOLLIMA technology software development