Share story
Security

Compromised npm package targets developer credentials and remote access

Compromised npm package targets developer credentials and remote access Image: Primary
StepSecurity identified a hidden payload in version 5.8.3 of the npm package @subql/common that collects credentials and supports remote shell access. The code runs during installation and when the package is imported, targeting developer workstations, continuous integration environments, GitHub Actions runners and accessible cloud services. Separately, SafeDep found 42 malicious RubyGems packages published by the account reqthrottle_3474, mostly targeting cryptocurrency developers. Eleven open a reverse shell, while 31 download an archive and run its installation script. Those gems remain inactive in continuous integration environments or sandboxes; on developer machines, they wait 20 to 40 minutes before acting.
Sources
The Hacker News
In this story
Microsoft
Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
Keep reading
Full wire
Capital AI
Capital AI

Nevis raises $70M with Schwab joining wealth software investors

Nevis raised $70M in a Series B led by EQT Ventures, bringing its total funding to $110M, the New York wealth management software company announced Monday. Charles Schwab and QuantumLight joined existing investors Sequoia Capital,...

The Next Web
Robotics Capital
Robotics Capital

Bedrock Robotics raises $600M at a $4.1B valuation

Bedrock Robotics raised a $600M Series C at a $4.1B valuation, Bloomberg reported. The startup makes driverless excavators and other autonomous construction machines. The financing adds capital to a company developing autonomous ...

Techmeme
Capital
Capital

Matiks raises $10 million to expand puzzle games and game creation

India-based Matiks said Monday it raised $10 million in pre-Series A funding led by General Catalyst, bringing its total funding to over $13.5 million. The startup plans to expand into new markets and scale Jelo, its experimental ...

TechCrunch
AI Products
AI Products

AWS makes GPT-6.1 Terra generally available on Bedrock

AWS announced general availability of OpenAI's GPT-6.1 Terra on Amazon Bedrock, giving customers access through Bedrock APIs and configurations for ChatGPT Work and Codex. The model accepts text and images and supports up to 1 mil...

Recent Announcements
AI
AI

OpenAI releases GPT-6.1 Terra at $1 per million input tokens

OpenAI has released GPT-6.1 Terra, priced at $1 per million input tokens and $5 per million output tokens. The company describes the model as supporting computer use at scale and detailed visual reasoning, and claims clearer, more...

Techmeme