Andrey Polkovnichenko retweeted
🚨 Anatomy of a Live npm Supply-Chain Campaign: "Equation of Compromise"
Threat actors are targeting developers with trojanized math libraries. The payload doesn't run for everyone, it only decrypts when the victim's code solves one specific linear matrix.
Read the full teardown of the trigger, payloads, and threat actor infrastructure on our blog: research.jfrog.com/post/equa…
Andrey Polkovnichenko retweeted
Evolution of a threat 🚨 The payload in the recent #AtomicArch campaign (hijacking 400+ AUR packages) is the exact same toolkit used in the earlier IronWorm attack.
🦀 Same Payload: Rust + eBPF rootkit, ChaCha-encrypted strings, Tor C2 (/api/agent), and broad stealer/Exodus trojanizer. 📦 Different Delivery: IronWorm was a self-replicating npm/GitHub worm, while this new wave hijacks orphaned AUR packages to propagate.
The software supply chain has a new predator. 🐛
Meet Iron Worm, the "rustier cousin" of the infamous Shai-Hulud worm. Just like its predecessor, it burrows into dev environments, steals credentials, and self-propagates through trusted GitHub and npm workflows.
Except this one is built in heavy, async Rust, hides behind an eBPF kernel rootkit, and talks over Tor.
Full teardown of the beast:
research.jfrog.com/post/iron…
Andrey Polkovnichenko retweeted
🚨 We’ve uncovered "Solana FakeFix" - a campaign of 20+ malicious npm and PyPI packages targeting Solana developers with fake fixes and trojanized libraries.
Don't let your secrets get stolen, learn more in our latest blog:
research.jfrog.com/post/sola…
1/5 That's a nice story, but I had a linguistic question bothering mě for some time: are the (לילית) Lilit and לילה (lailah, night) related somehow linguistically? And I think I found the most comprehensive answer in the DDD book.
4/5 It's not surprising that when this word entered Semitic languages, people (like me) noticed its similarity to the word for 'night.' Because of its succubian nature, it naturally became associated with night creatures. And after a time, it replaced the original meaning.
5/5 In this way, old translations of the Bible (for example, 'lamia' in the Vulgate and 'onokentaur' in the Septuagint) kept their demonic nature. Later biblical translations, such as Russian versions, drift toward their night semantics, interpreting it as a night ghost, an animal, a beast, or a bird.
Tried that Fable to rewrite my old project for Czech pronunciation training. And it's shown the next level from the very beginning. I couldn't come up with a better name for the project. E:\czpron
Every language looks scary when you explain it to an English-speaking person. First, I encountered את in Duolingo, and the explanation there was really hard to follow: it's kind of a definite article, but it's used only in certain cases to show the subject and object. Fortunately, it was times when Duolingo wasn't shit yet. And some good soul wrote in the comments that it's accusative. And it's the only explanation that was needed
That was when I started learning Czech. Our teacher, who usually taught Americans, decided to showcase the language's complexity using the accusative case. She started, "You know, in some cases, the ending of the word changes, but not always. If it's animate, it changes, otherwise, it isn't. And 'animate' doesn't mean it's alive. For example, the word 'snowman' is not actually alive, but should change."
And I can see how that would blow your mind if your native language is English, but since my own language works exactly the same way, I just nodded along.
Andrey Polkovnichenko retweeted
🚨 New PyPI variants found, now with prompt injection to bypass AI scanning:
[email protected]
[email protected]
[email protected]
[email protected]
Our blog will be updated soon with the technical details.
🚨 Supply Chain ALERT New Phase of “Miasma: The Spreading Blight” 🚨
A new wave of the npm supply chain campaign, Miasma: The Spreading Blight
Targets include @vapi-ai/server-sdk & ai-sdk-ollama. Attackers are using a new autorun install method exploiting node-gyp shell expansion.
We have updated our previous blog:
research.jfrog.com/post/shai…
Andrey Polkovnichenko retweeted
It appears miasma has made it back to @Microsoft.
github.com/Azure/durabletask…
github.com/search?q=%22node%…
Andrey Polkovnichenko retweeted
The software supply chain has a new predator. 🐛
Meet Iron Worm, the "rustier cousin" of the infamous Shai-Hulud worm. Just like its predecessor, it burrows into dev environments, steals credentials, and self-propagates through trusted GitHub and npm workflows.
Except this one is built in heavy, async Rust, hides behind an eBPF kernel rootkit, and talks over Tor.
Full teardown of the beast:
research.jfrog.com/post/iron…
Andrey Polkovnichenko retweeted
🚨 AI Supply Chain Risk Discovery: The JFrog Security Research team found 3 critical flaws in PickleScan. The flaws allow malicious PyTorch models to evade detection, posing a severe risk to the AI supply chain.
Action: Update PickleScan to v0.0.31 and implement a layered defense.
Read the full technical breakdown and protective guidance: jfrog.co/4iwTEVQ
#AISecurity #PyTorch #MLOps #DevSecOps #Cybersecurity #SupplyChainSecurity
Since I'm stuck at home with the flu this weekend, I'm planning to finish 137: Jung, Pauli, and the Pursuit of a Scientific Obsession. The whole premise already sounds like a fever dream: a genius physicist meets a genius therapist, and they end up reinforcing each other's fascination with the symbolism of the number 137.
Cutting-edge physics, psychoanalysis, Kabbalah, science, and just a hint of madness. No way this could happen in real life but it did.
goodreads.com/book/show/6656…
I was lucky enough to catch the last train from about to be occupied Luhansk to the rest of Ukraine in 2014. Then, in 2022, I crossed the border on the very first day of the war.
But every now and then I have dreams where I didn't manage to leave, got stuck there and go through various unpleasant adventures.
And I was actually surprised to find how common this is: there's even a research published in 1988, describing Czechoslovak migrants having the same kind of nightmares.
onlinelibrary.wiley.com/doi/…
Andrey Polkovnichenko retweeted
The 12th Annual Flare-On Challenge kicks off Sept 26 at 8PM EST!
Reverse engineering pros, from Windows to Web3 (with a YARA twist), it's your time to shine. 🏆
Get ready → bit.ly/4ofb5g8
#FlareOn12








