Popular open-source projects used by developers worldwide have become targets of a cyberattack. Cybersecurity firms StepSecurity and SafeDep warned about a new wave of attacks known as "supply chain" attacks. Attackers aim to compromise developer accounts of open-source projects to distribute malicious updates to users. This is reported by Techcrunch.com reports .
According to SafeDep, hackers took control of a single developer's account in just 20 minutes, releasing over 630 malicious versions across 317 packages. The main goal of this attack is to steal access credentials for various services like password managers and to propagate malware more widely. The affected packages include the Antv library owned by Alibaba.
According to JFrog Security, in some cases, hackers uploaded malicious updates directly to the GitHub platform. Researchers have dubbed this series of attacks "Mini Shai-Hulud." This campaign is part of a large-scale threat targeting open-source projects and the developers who use them.
Last week, as part of the "Mini Shai-Hulud" attacks, hackers managed to access computers belonging to two OpenAI employees by compromising the TanStack open-source library. OpenAI is one of many organizations affected by this cyberattack.
Read “Zamin” on Telegram!
