wrhn

6mile

Joined 5 years ago

Karma
141
Submissions
61
Member since
Dec 30
Software supply chain research, created GitHax, threat intel platform for supply chain threats and former founder of SecureStack. Author of open-source projects like the DevSecOps Playbook, TVPO threat modelling framework, and more.
View on Hacker News

Recent submissions

Comment · 9 days ago
Turns out that naming matters and when Imperva named this bug "Node2Shell" they did us a disservice. This bug affects Python via two packges: brotli and brotlicffi. All versions are vulnerable except the latest.
Comment · 3 months ago
DPRK has created a new leaner technique to obfuscate its C2 payloads with NullReceiver. The NPM packages call the Ethereum blockchain directly to find hidden addresses in the destination.
Comment · 3 months ago
Because the Go and Packagist registries don't require additional publishing credentials like NPM and PyPI North Korean threat actors have been able to compromise legitimate packages via their PolinRider campaign.
Comment · 4 months ago
NPM attack targeting Mastro targets browser extensions other than crypto wallets.

- Credential managers and MFA authenticators from LastPass, Bitwarden, 1Password, Deloitte, Dashlane, ExpressVPN, KeePass, Proton, Kaspersky, passbolt, NordPass, Zoho, etc. - Zapier browser extension. Assuming this is to gain access to platforms the victim has integrated with Zapier

Comment · 4 months ago
Signs point to the Miasma worm, but this is unconfirmed yet.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton