ทวีตที่ปักหมุด
We're proud to announce that $PRO tokens are now fully integrated into our play-to-learn-to-earn video game, "LIQUIDITY RANGER" launching soon on @farcaster_xyz.
English
Solriah
2.9K posts
Solriah
@Solriah
Community lead @ProAgentAI | $PRO | Building @liquidityranger | UI/UX Designer 💎
เข้าร่วม Şubat 2022
1K กำลังติดตาม656 ผู้ติดตาม
Solriah รีทวีตแล้ว
do you understand what just happened to one of the most used npm packages on the internet?
→ axios gets downloaded over 100 million times a week and today it got compromised
→ an attacker hijacked the npm credentials of a lead axios maintainer… changed the account email to an anonymous ProtonMail address… and manually published two poisoned versions
→ axios@1.14.1 and axios@0.30.4… neither version contains a single line of malicious code inside axios itself. instead they inject a fake dependency called plain-crypto-js that drops a remote access trojan on your machine
→ the fake dependency was staged 18 hours in advance… three separate payloads were pre-built for macOS, Windows, and Linux… both release branches were hit within 39 minutes. every trace was designed to self-destruct after execution too
→ there’s no tag in the axios GitHub repo for 1.14.1. it was published outside the normal release process entirely... bypassed CI/CD completely
→ StepSecurity called it one of the most operationally sophisticated supply chain attacks ever against a top 10 npm package
→ a routine npm install silently opens a backdoor… no warning… no suspicious code visible in axios itself
this is the wake up call all vibe coding bros need to hear right now:
→ if you installed either version… assume your system is compromised
→ pin to axios@1.14.0 or axios@0.30.3
→ rotate all secrets, API keys, SSH keys, and credentials on affected machines
→ check network logs for C2 connections
→ add –ignore-scripts to CI npm installs going forward
100 million weekly downloads and one compromised maintainer account…
that’s all it took to wreak absolute havoc
and I imagine we see a whole lot more of these… crazy times ahead for cybersecurity and vibe coding
be safe out there y’all
Feross@feross
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
English
Solriah รีทวีตแล้ว
March wrapped 🔁
Thousands of Rangers jumped in this month, nearly 6,000 opens, over 2,500 onchain transactions, close to 1,000 Rangers added the mini app, with rewards of over $250 distributed in $PRO.
We hit #14 globally on farcaster.🎉
Happy Ranging into the new month 🧑🚀🚀
English
Might start doing a 5 - 10k Spenda breakie every morning, my actives no fit dey stay hungry🙂↔️🙂↔️🙂↔️
10FIGS@iapecooks
It's a Saturday morning, what did you have for breakfast?
English
