coin-img-ETHETH-3.07%coin-img-BTCBTC-2.29%coin-img-HYPEHYPE-4.72%coin-img-BITKBITK-56.52%coin-img-SOULCORESOULCORE-20.28%coin-img-SOLSOL-3.06%coin-img-XRPXRP-2.68%coin-img-USDCUSDC+0.01%coin-img-ETHETH-3.07%coin-img-BTCBTC-2.29%coin-img-HYPEHYPE-4.72%coin-img-BITKBITK-56.52%coin-img-SOULCORESOULCORE-20.28%coin-img-SOLSOL-3.06%coin-img-XRPXRP-2.68%coin-img-USDCUSDC+0.01%coin-img-ETHETH-3.07%coin-img-BTCBTC-2.29%coin-img-HYPEHYPE-4.72%coin-img-BITKBITK-56.52%coin-img-SOULCORESOULCORE-20.28%coin-img-SOLSOL-3.06%coin-img-XRPXRP-2.68%coin-img-USDCUSDC+0.01%coin-img-ETHETH-3.07%coin-img-BTCBTC-2.29%coin-img-HYPEHYPE-4.72%coin-img-BITKBITK-56.52%coin-img-SOULCORESOULCORE-20.28%coin-img-SOLSOL-3.06%coin-img-XRPXRP-2.68%coin-img-USDCUSDC+0.01%
user-avatar
Shiraz Jagati

Mini Shai-Hulud GitHub Actions worm taints 300+ npm packages with 16M weekly downloads

A self-replicating "Mini Shai-Hulud" worm abused GitHub Actions on May 19 to push malicious releases, impacting AntV-related packages, echarts-for-react, and Microsoft's durabletask SDK across an estimated 16 million weekly downloads. The malware is designed to steal cloud and developer credentials and includes a dead-man's switch that can wipe a developer's home directory if the attacker-created npm token is revoked. GitHub said on May 20 it would roll out staged publishing, expand OIDC trusted publishing, and move away from legacy tokens.
BTC
BTC-2.32%
SOL
SOL-3.08%
Klauzula wyłączenia odpowiedzialności: Powyższe treści są wyrazem opinii autora i nie stanowią opinii BingX. Nie należy ich traktować jako porady inwestycyjnej od BingX. Sprawdź szczegóły w regulaminie.