/
ttps_attack:T1614.001 × latest_source_host:safedep.io × limpar

Resultados

2 casos · pág. 1/1

safedep.io · high

sckit: Go implant framework found in MemTensor npm and PyPI packages steals developer and CI credentials for supply chain worm spread

SafeDep analyzed sckit (the "supplychain.local worm"), a previously unreported cross-platform Go implant framework found on September 23, 2026 in the compromised MemTensor packages @memtensor/email protected (npm) and email protected (PyPI). It harvests credentials from developer machines and CI jobs, takes signed tasks from a C2 server, …

technology software development
safedep.io · critical

tensorlake 0.5.144 npm package compromised to deliver Mini Shai-Hulud credential-stealing worm

SafeDep identified a malicious tensorlake npm release, version 0.5.144 (about 106,000 monthly downloads), that ran a Mini Shai-Hulud worm on install. It was published at 01:12:07 UTC on 8 October and flagged by SafeDep eight minutes later. The attacker used a repository administrator account to commit the payload to main through the GitHu…

technology software development