1aN0rmus

The last few months I have had so much fun rapidly prototyping personal and @permisosecurity projects. I treat every weekend as a hackathon. Using @cursor_ai has been a game changer for me to be able to crank out fast and mostly polished POCs. Today, I'm gonna showcase some of of these!

@gamemakerstk Don't forget to give the game arating if you try it out itch.io/jam/gmtk-jam-2…

The kids and I participated in the @gamemakerstk game jam this weekend. Check out our game "Seed & Stake" to go with the theme "Count Down" permiso.itch.io/seed-and-stake

Expanded the reporting a little more with some supply chain love :) derp.ca/npm/ also fixed a reporting bug i had on the numbers with Ransomware so thats now accurate.

I'm excited to be joining an awesome group of people to speak on Threat Hunting at @BlueTeamVillage. More details to come soon I'll be in Vegas for BSidesLV through DEFCON. A long week but worth it to catch up with some awesome people

@usmntonly When that beat drops!

THE TELEMUNDO CALL OF THE MALIK TILLMAN FREE KICK IS THE BEST THING YOU'LL EVER HEAR 🇺🇸🦅❤️

Making games with fable is such a joy! I haven’t tested much else yet, but definitely the best model for game dev. Downloadable for iOS

Oh cool, free-anthropic-claude from anthropic-clause. An "official anthropic sdk" on npm. Real cache library glued to a python wallet stealer loader. No python? No problem. It installs miniconda so the second stage runs regardless.

While Fable was live, my test project was this quick iOS game I created for the kids inspired by one of our faves (Sushi Cat)! lnkd.in/eDjaB8DC This was a seriously impressive model on the game dev side, didn't get to test much else out. Look forward to playing with Fable more once it hits the streets again!

NPM Malware > - Obfuscated postinstall hook (.prepare.cjs) uses char-code arrays to hide sensitive variable names - Credential harvesting targeting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN - Exfiltration endpoint at open[.larksuite[.com (Feishu bot webhook) acts as C2 - Explicit sandbox evasion logic checking for SANDYCLAW, OPENCLAW, PERMISO, CHAINRADAR env https[://www[.npmjs[.com/package/ash-claw/v/1.7.13 https[://sandyclaw[.permiso[.io/shared/5PVyO_QI-Y0ENhwni99JtULn_f8oVSMpqWXiYktq5E4 @TekDefense 😂

🤩 We just wrapped up 2 days of my training Practical AI for Threat Intel in Sydney! It was packed and the class was fantastic! If you want to step up your skills and learn faster from our latest research, the next session will be hosted at @BlackHatEvents in August! #practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-504171770249968" target="_blank" rel="nofollow noopener">blackhat.com/us-26/training…

@leerob Composer 2.5 is my main driver for all dev work on SandyClaw. Fast and smart!

We're training the next version of Composer... with Composer! The model is always learning from itself. This kind of "recursive self-improvement" might sound new, but it's been happening for many months! For example, training big models requires creating *lots* of data for RL - essentially games the model plays to improve at any task you can grade. The newest models can configure their own environments to make those games playable (auto-installing dependencies, fixing broken setups). Composer 2 was *dramatically* better at this than version 1. So the better the model gets, the better it gets at creating the conditions to train its successor. Each generation unlocks capabilities the previous one didn't have! So cool. x.com/cursor_ai/stat…

GitHub announces npm security changes to tackle supply-chain attacks bleepingcomputer.com/news/security/…

I think I should be flattered! First ITW package that specifically tries to evade SandyClaw (unsuccessfully) sandyclaw.permiso.io/shared/DTAxqGi… Great find @KirkDerpca ! npmjs.com/package/visa-r…

// CI/CD sandbox detection (prefix-based, catches all SandyClaw/OpenClaw/Permiso variants) 🤷‍♂️ sandyclaw.permiso.io/shared/DTAxqGi… (Malicious) https[://www[.npmjs[.com/package/visa-response/v/1.4.4-beta?activeTab=code

Great team over there 👇🏼

🤓 This morning at @SLEUTHCON, I talked about how AI is being targeted and leveraged by cybercriminals. Which is beyond simply using models in their operations, attackers are also actively targeting AI environments themselves. That AI agent you trusted inside your organization is becoming a prime target because you don’t know what it is doing while it is running. And attackers know it. 💀

NPM Malware > Shai-Hulud Supply Chain Attack (Now) @ethlete/query/v/5.43.2" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… @ethlete/dsp/v/0.3.1" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… @ethlete/cdk/v/4.71.2" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… @ethlete/theming/v/2.7.1" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… @ethlete/cli/v/2.0.1" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… @ethlete/contentful/v/3.9.1" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… @ethlete/types/v/1.11.4" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… @ethlete/core/v/4.31.1" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… npmjs.com/package/github… @forjacms/analytics/v/1.8.5" target="_blank" rel="nofollow noopener">npmjs.com/package/@forja… npmjs.com/package/dbmux/… npmjs.com/package/discor… @forjacms/sections/v/1.8.5" target="_blank" rel="nofollow noopener">npmjs.com/package/@forja… @forjacms/client/v/1.8.5" target="_blank" rel="nofollow noopener">npmjs.com/package/@forja… @ethlete/components/v/3.3.1" target="_blank" rel="nofollow noopener">npmjs.com/package/@ethle… @forjacms/sections-react/v/1.8.5" target="_blank" rel="nofollow noopener">npmjs.com/package/@forja… npmjs.com/package/create… + more continually dropping

NPM Malware > 3 Packages, all malicious, multiple versions. "Security Research Honeypot" that wants to exfil your corp OneDrive var hasCorpOneDrive = !!env.ONEDRIVECOMMERCIAL; 🤷‍♂️ 46[.224.67.169:3000 https[://www[.npmjs[.com/~deathpoolxrs Sandbox: sendgrid-sdk@0.2.4: sandyclaw.permiso.io/packages/cde21… twilio-sdk@0.2.4: sandyclaw.permiso.io/packages/6d244… gpt-sdk@0.2.4: sandyclaw.permiso.io/packages/d1941…