
Ryan Sadowski
7.5K posts

Ryan Sadowski
@FakeUncleNemo
Building the world's best Mac screen recorder https://t.co/GPgZquqscX | https://t.co/rPrKq8bqFt 👈 PostHog iOS Widget | Aspiring Chicken Farmer 🐔 |




なんで曲がっているのかと思ったら、プライマー(雷管)に当たらないようにかな。面白いね、興味深い。

🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading. Newly confirmed compromised artifacts: @opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads) mistralai: 2.4.6 on PyPI guardrails-ai: 0.10.1 on PyPI additional @squawk/* packages on npm guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.pyz, writes it to /tmp/transformers.pyz, and runs it with python3 without integrity verification. The git-tanstack.com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds Regardless I just came to say hello :^)” The page also linked to a YouTube video and you can probably guess which one.

Our official post mortem on the security issue earlier today: tanstack.com/blog/npm-suppl…














