Sabitlenmiş Tweet
muffindev
2.4K posts
muffindev retweetledi
🚨 Hay una movida del Gobierno de @petrogustavo que tiene prendidas las alarmas en el sector de las telecomunicaciones.
Y aunque suene técnico, esto podría impactar este mercado en Colombia. Algo que nos afectaría a todos. 🧵
GIF
Español
muffindev retweetledi
¡Han migrado Bun a Rust! 1 millón de líneas añadidas.
1350 archivos modificados. Qué locura...
Español
muffindev retweetledi
🚨 UPDATE: 19 MILLION exposed NGINX instances hit by the 18-year-old NGINX RCE found by AI.
Top exposure by country:
- United States: 5,340,011
- China: 2,540,008
- Germany: 1,871,780
Note on ASLR as added security: not all of these instances will have ASLR disabled, but every one of them is running a version inside the vulnerable band.
The vulnerability is a heap buffer overflow. ASLR randomizes memory layout, which makes reliable RCE much harder because the attacker cannot predict where their payload or useful gadgets land. But the overflow itself still happens. The corrupted memory still causes the NGINX worker process to crash.
ASLR-enabled hosts are still trivially DoS-able. ASLR-disabled or non-PIE builds are RCE-able. Either way, patch ASAP!
International Cyber Digest@IntCyberDigest
‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code. - Affects NGINX 0.6.27 through 1.30.0 - Triggered via the rewrite and set directives in config - Update NGINX ASAP - NGINX is a widely used HTTP web server, be sure to check its prevalence in other products
English
muffindev retweetledi
El momento de la ciberseguridad y la inteligencia artificial es ahora cuandoo tengamos Claude Mythos:
> Mythos es real (los más de 400 bugs encontrados y arreglados en Firefox)
> Pero mientras Google identifica a un actor criminal utilizando inteligencia artificial para explotar un problema de seguridad zero-day por primera vez
> apuntan a la escalada en el uso de la IA por parte de China y Corea del Norte: los ciberdelincuentes y crackers de esos países, obviamente, ya están utilizando la IA
> el modelo clásico en ciberseguridad de "divulgación responsable a 90 días" fue diseñado para un mundo donde encontrar bugs era difícil y desarrollar exploits era lento. Está acabado
¿Y cómo es el nuevo mundo de la ciberseguridad? Uno en el que se exige tratar toda vulnerabilidad crítica como prioridad cero y parchear ya, no en el próximo sprint. El creador del software tiene que actuar de inmediato también: debe iniciar la corrección cuando llega el reporte. Los investigadores deben pedir ventanas más cortas antes de avisar en abierto (nada de 90 días, pasar a unos pocos), y la gestión de vulnerabilidades debe operar en tiempo real.
Como en otros sectores, el problema de la inteligencia artificial ha pasado, a velocidad de vértigo, de ser “es demasiado mala, se equivoca mucho” a “es demasiado buena”.
error500.net/p/mas-alla-de-…
Español
muffindev retweetledi
Privacy shouldn't be hidden in the advanced settings menu… it should be the default.
English
muffindev retweetledi
La teoría del nudge (empujoncito conductual) consiste en modificar sutilmente el contexto en el que las personas toman decisiones para guiarlas hacia opciones más beneficiosas, sin prohibir nada ni limitar su libertad de elección. Ejemplos clásicos son poner las comidas saludables en primer lugar del menú, inscribir automáticamente a las personas en planes de pensiones o hacer que la opción ecológica sea la predeterminada.
En este artículo, dos autores que fueron anteriormente partidarios entusiastas de esta aproximación -Nick Chater(Universidad de Warwick) y George Loewenstein (Carnegie Mellon)- realizan una crítica bastante dura de la teoría del nudge. Según ellos, los grandes meta-análisis recientes muestran que los efectos de los nudges son muy pequeños, efímeros y difíciles de escalar a gran nivel.
Pero es peor aún, ya que al centrar tanto la atención en la responsabilidad individual, esta aproximación ha contribuido involuntariamente a un proceso llamado “responsabilización”. Esto consiste en desplazar la culpa de los problemas sociales y ambientales hacia cada persona, en lugar de exigir cambios a las grandes empresas y sistemas que los generan.
De esta forma, las petroleras destacan la responsabilidad de los conductores y de quienes viajan en avión, las empresas de plásticos insisten en la “basura individual” que tiramos, y la industria de alimentos ultraprocesados culpa a las “malas elecciones” de los consumidores. Así se evita el debate incómodo sobre regulaciones fuertes, impuestos o límites a las prácticas corporativas que realmente impulsan el cambio climático, la contaminación por plásticos o la epidemia de obesidad.
Los autores reconocen que cada persona debe seguir haciendo su parte con mejores elecciones de consumo, pero advierten que los nudges suaves nunca serán suficientes para resolver crisis profundas como el cambio climático, la obesidad o la contaminación. Concluyen que se necesita voluntad política colectiva para cambiar las reglas del sistema (regulaciones, incentivos y estructuras de mercado), en lugar de confiar solo en pequeños empujoncitos a los individuos.
Rob Sica@robsica
"By focusing attention on individual responsibility for the world’s problems, behavioural scientists may have inadvertently assisted a broader process known as 'responsibilisation'" theconversation.com/nudge-theory-w…
Español
muffindev retweetledi
the official OpenSearch client for Node.js has also been compromised
Socket@SocketSecurity
🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading. Newly confirmed compromised artifacts: @opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads) mistralai: 2.4.6 on PyPI guardrails-ai: 0.10.1 on PyPI additional @squawk/* packages on npm guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.pyz, writes it to /tmp/transformers.pyz, and runs it with python3 without integrity verification. The git-tanstack.com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds Regardless I just came to say hello :^)” The page also linked to a YouTube video and you can probably guess which one.
English
muffindev retweetledi
Millones de colombianos en riesgo por el mayor leak financiero documentado muchohacker.lol/2026/05/millon…
Español
muffindev retweetledi
muffindev retweetledi
Easiest way to protect yourself:
1. Use pnpm
2. Set a minimum-release-age
TANSTACK@tan_stack
SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/route… Credit to the security researcher for responsible disclosure.
English
muffindev retweetledi
🇨🇴 A threat actor on an underground forum is claiming to be selling an alleged 3 TB data leak associated with SmartQuick.
According to the forum post:
• The actor claims to possess internal and confidential databases from smartquick.com.co
• The alleged dataset reportedly includes QA and web production data
• References to logistics and commercial process platforms were mentioned
• The asking price was listed at approximately $500 USD
• Multiple internal/admin-related domains were referenced in the post
The actor describes SmartQuick as a technology and mobile application platform focused on:
• Logistics optimization
• Tracking systems
• Commercial process management
At this time:
• The claims remain unverified
• No independent confirmation of a compromise has been established
• The authenticity, age, and completeness of the alleged dataset are unknown
Potential risks from exposed production and QA environments may include:
• Exposure of internal credentials or API keys
• Client or operational data disclosure
• Supply chain compromise risks
• Infrastructure mapping opportunities for attackers
• Credential reuse and pivoting attacks
Organizations should immediately assess:
• Separation between QA and production environments
• Public exposure of admin panels
• Credential hygiene and MFA enforcement
• Cloud storage and backup access controls
• Web application logs and anomalous access activity
• Third-party/vendor integrations
If legitimate, exposed QA environments can be particularly dangerous because they may contain:
• Hardcoded credentials
• Test accounts with elevated privileges
• Debugging information
• Staging copies of production data
• Internal architecture details
Daily Dark Web is monitoring underground communities for additional indicators, leaked samples, or validation attempts related to this alleged incident.
#DDW #Intelligence #Colombia #CyberSecurity #DarkWeb #DataLeak #ThreatIntelligence #SupplyChain #LogisticsSecurity #WebSecurity
English
muffindev retweetledi
¿En qué momento nos convencieron que, cuando un trabajador aguanta abusos, “es buen trabajador”, pero cuando exige derechos es “conflictivo”?
Español
muffindev retweetledi
Easier way to protect yourself (if you are not infected yet) is to set a minimum release age in your package manager.
For @npmjs:
`npm config set min-release-age=2d`
For @pnpmjs:
`pnpm config set minimumReleaseAge 2880`
For @bunjavascript:
```
# In bunfig.toml
[install]
minimumReleaseAge = 172800
```
For Yarn:
`yarn config set npmMinimalAgeGate "48h"`
International Cyber Digest@IntCyberDigest
‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you. The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads. The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate. Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.
English
muffindev retweetledi
tech industry is optimizing itself to death.
Polymarket@Polymarket
JUST IN: GitLab announces job cuts to reinvest in growth for the “agentic era.”
English
muffindev retweetledi
‼️🚨 UPDATE: The TanStack npm attack is now a full campaign.
'Mini' Shai-Hulud has hit:
- OpenSearch
- Mistral AI
- Guardrails AI
-UiPath
- Squawk packages across npm and PyPI
The malware specifically targets AI developer tooling. It hooks into Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to re-execute on every tool event, long after the infected package is gone. npm uninstall does not fix this.
International Cyber Digest@IntCyberDigest
‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you. The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads. The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate. Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.
English
muffindev retweetledi
TL;DR for open-source maintainers
🚫 NEVER use "pull_request_target" workflows
🚫 NEVER use shared caches in your publish pipeline
Combining these 2 in particular is extremely dangerous
I've repeated this countless times over the years, but another reminder is always useful
TANSTACK@tan_stack
SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/route… Credit to the security researcher for responsible disclosure.
English
muffindev retweetledi
🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading.
Newly confirmed compromised artifacts:
@opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads)
mistralai: 2.4.6 on PyPI
guardrails-ai: 0.10.1 on PyPI
additional @squawk/* packages on npm
guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.pyz, writes it to /tmp/transformers.pyz, and runs it with python3 without integrity verification.
The git-tanstack.com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds
Regardless I just came to say hello :^)”
The page also linked to a YouTube video and you can probably guess which one.
English
muffindev retweetledi
‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you.
The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads.
The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate.
Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.
English