Security alert: social engineering campaign targets technology industry employees - The GitHub Blog
github.blog
GitHub has identified a low-volume social engineering campaign that targets the personal accounts of employees of technology firms. No GitHub or npm systems were compromised in this campaign. We’re publishing this blog post as a warning for our customers to prevent exploitation by this threat actor.
  • style99@kbin.social
    1·
    1 year ago

    Examine dependencies and installation scripts. Very recently published, net-new packages, or scripts or dependencies that make network connections during installation should receive extra scrutiny.

    I’m a little surprised npm doesn’t already do this and give you a big blinking warning in the install process about it.

  • DangerousDetlef@lemmy.worldEnglish
    1·
    1 year ago

    The really scary thing is probably the malicious npm dependencies. If I think about the projects at work with and all the different packages and the hundreds of dependencies no one knows. And it’s probably even worse in really big companies like Microsoft or Facebook, they probably got thousands across their products. I hope for us all that they scan them very regularly.

    • bassomitron@lemmy.worldEnglish
      0·
      1 year ago

      This is why my work will only use enterprise supported distros like RHEL. We don’t have the manpower to stay on top of every single package update to ensure they’re absolutely safe.