This too shall pass. Used to tweet about programming and infosec. Likes people, science, and music. Swedish & English. jonelf @ Keybase • jonelf.89 @ Signal
Sweden
Joined December 2008
- Tweets69.1K
- Following978
- Followers1K
- Likes23.3K
Jonas retweeted
”Bara för att vi förlorar mot Mjällby i cupfinalen så betyder inte det att vi är världens sämsta lag. Och bara för att vi vinner mot MFF så betyder inte det att vi är världens bästa lag. Jag brukar säga till de unga i truppen, behåll fötterna på jorden & jobba hårt” - Besara ❤️
Jonas retweeted
🚨 Another major supply chain incident 🚨
axios — one of the most widely used npm packages — has been compromised. Malicious versions [email protected] and [email protected] were published and are actively dropping malware.
The attack pulls in a newly created dependency [email protected], confirmed as a malicious loader: it executes obfuscated payloads, runs shell commands, and attempts to evade detection while wiping traces.
With 100M+ weekly downloads, this is a live, large-scale supply chain attack.
More details: stepsecurity.io/blog/axios-c…
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
Jonas retweeted
New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads.
Scanning my system I found a use imported from googleworkspace/cli from a few days ago when I was experimenting with gmail/gcal cli. The installed version (luckily) resolved to an unaffected 1.13.5, but the project dependency is not pinned, meaning that if I did this earlier today the code would have resolved to latest and I'd be pwned.
It's possible to personally defend against these to some extent with local settings e.g. release-age constraints, or containers or etc, but I think ultimately the defaults of package management projects (pip, npm etc) have to change so that a single infection (usually luckily fairly temporary in nature due to security scanning) does not spread through users at random and at scale via unpinned dependencies.
More comprehensive article:
stepsecurity.io/blog/axios-c…
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
Jonas retweeted
Är nästan aldrig här men om algoritmerna gör så du ser detta så letar nya uppdrag! Kan göra tv, radio, poddar, skriva allt möjligt och koka kaffe. Så om du vill jobba med mig eller bara säga hej: hör av dig. Intresserad av allt! RT=kärlek!
Still a KeyPass user
Installing KeePass 2 and will probably let Nullsoft SafeSex down after all these years. keepass.info 1014.org/code/nullsoft/safes…
Det här med att vi fullständigt dominerar matcherna men inte gör mål börjar bli riktigt frustrerande!
Jonas retweeted
INSANE SUPPORTER TURNOUT FOR HAMMARBY MARCH TO MATCH IN SWEDEN. Fans showed up for the Stockholm side's season-opener after Bajen came in 2nd last season 🙌