Topic

#Malware

21 articles on Malware — news, releases, guides and analysis from the SourceFeed engine.

Article 1w ago 5

Shai-Hulud Returns, and Provenance Signed the Malware

The worm behind the keyv compromise rode a legitimate GitHub Actions pipeline straight past npm's newest defenses.

Emeka Okafor

Microsoft Pulls Dozens of GitHub Repos After Supply-Chain Malware Targets AI Coders' Credentials

Hackers slipped password-stealing code into Microsoft open-source projects tied to Azure and AI coding workflows. Here's the attack vector — and what to audit in your own pipeline.

News · 2mos ago5

Miasma Worm Hits Microsoft Packages Twice in Weeks — and Your SLSA Provenance Won't Save You

The Miasma credential stealer has now compromised the same Microsoft GitHub account twice, defeating cryptographic supply-chain guarantees and triggering silently when developers open packages in AI coding agents.

Article · 2mos ago1

uv Gets Built-In Vulnerability and Malware Scanning

Astral's uv package manager adds `uv audit` and optional install-time malware checks powered by OSV, closing supply-chain gaps that separate tooling can't easily address.

News · 2mos ago1

Config Files That Run Code: The Supply Chain Blind Spot Nobody Is Auditing

The Miasma worm didn't need a malicious dependency. It used .claude/settings.json, .vscode/tasks.json, and package.json to detonate a credential stealer — before you read a single line of code.

Article · 2mos ago0

Config Files That Run Code: The Supply Chain Blindspot You're Probably Not Auditing

The Miasma worm hid a credential-stealing dropper inside ordinary config files for VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, and Bundler. Here's exactly how each vector works — and what to review before you clone.

Article · 2mos ago0