CIRCLE WITH A DOT

Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files https://www.stepsecurity.io/blog/miasma-and-hades-are-spreading-now-detect-them-on-developer-machines-with-suspicious-files#Security #SupplyChain #DevSecOps

@Harlander I've got at least 3---levothyroxine, methotrexate, and Concerta. Probably wouldn't get very far without antihistamines, either. Ironic, considering I have a pretty good selection of useful skills for a low-resource situation.

Why Does It Take Years to Get a Patriot Missile From Factory to Front Line?https://www.wsj.com/world/why-does-it-take-years-to-get-a-patriot-missile-from-factory-to-front-line-3e5874c5#Defense #Geopolitics #SupplyChain

Provided by @altbot, generated privately and locally using Gemma4:26b@kali A four-panel black and white comic strip featuring stick figures. In the first panel, a stick figure points to a graph with a horizontal axis labeled "TIME" and a vertical axis labeled "THINGS:", where a line moves from "GOOD" toward "BAD" with text: "HERE'S THE SITUATION: THIS LINE IS HERE. BUT IT'S GOING UP TOWARD HERE." The second panel features three stick figures and the text, "SO THINGS WILL BE BAD? UNLESS SOMEONE DOES SOMETHING TO STOP IT. WILL ANYONE DO THAT? ...WE DON'T KNOW. THAT'S WHY WE' WE'RE SHOWING YOU THIS." The third panel depicts two stick figures with the text, "SO YOU DON'T KNOW, AND THE GRAPH SAYS THINGS ARE NOT BAD. BUT IF NO ONE ACTS, THEY'LL BECOME BAD." The fourth panel shows three stick figures with the text, "WELL, PLEASE LET ME KNOW IF THAT HAPPENS! BASED ON THIS CONVERSATION, IT ALREADY HAS." Energy used: 0.697 Wh

Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack https://www.stepsecurity.io/blog/microsofts-durabletask-pypi-package-compromised-in-supply-chain-attack#Security #SupplyChain #DevSecOps

RubyGems 4.0.13 adds a cooldown feature to Bundler for newly published gems.The opt-in setting lets projects delay dependency resolution for new gem versions, reducing exposure during the short window when malicious releases often spread fastest.https://socket.dev/blog/rubygems-adds-bundler-cooldown https://bsky.app/profile/socket.dev/post/3mnjjpjpgoc2w#Security #SupplyChain #Bluesky

@pnpm.io 11.5 adds support for recognizing npm staged publishes after staged approval metadata triggered a false downgrade signal.As npm adds more release paths, registry metadata needs to make it clear how each package version was published.https://socket.dev/blog/pnpm-11-5-adds-support-for-recognizing-npm-staged-publishes https://bsky.app/profile/socket.dev/post/3mngudpejss2x#Security #SupplyChain #Bluesky

Multiple redhat-cloud-services npm Packages compromised https://www.stepsecurity.io/blog/multiple-redhat-cloud-services-npm-packages-compromised#Security #SupplyChain #DevSecOps

OSV has withdrawn 157 malware reports after automated detections incorrectly flagged npm and PyPI packages as malicious, pushing bad records for trusted projects into OSV-consuming security tools and CI/CD systems.https://socket.dev/blog/osv-withdraws-157-malware-reports https://bsky.app/profile/socket.dev/post/3mmtsbeufhs22#Security #SupplyChain #Bluesky

Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets https://www.stepsecurity.io/blog/laravel-lang-supply-chain-attack#Security #SupplyChain #DevSecOps

Supply chain attack on the Laravel Lang organization:700+ historical versions across multiple community-maintained Laravel Lang packages were compromised with an RCE backdoor, including:laravel-lang/lang laravel-lang/http-statuseslaravel-lang/attributesLaravel-Lang/actionshttps://socket.dev/blog/laravel-lang-compromise https://bsky.app/profile/socket.dev/post/3mmijb36b4k2v#Security #SupplyChain #Bluesky

Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories https://www.stepsecurity.io/blog/megalodon-mass-github-actions-secret-exfiltration-across-5-500-public-repositories#Security #SupplyChain #DevSecOps

5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough https://www.stepsecurity.io/blog/5-supply-chain-attacks-in-48-hours-why-securing-one-layer-is-not-enough#Security #SupplyChain #DevSecOps

314 npm packages just got compromised, 271 @antv, echarts-for-react, size-sensor, timeago.js (safedep.io)https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/#npm #supplychain #attack #security

Active Supply Chain Attack: Malicious node-ipc Versions Published to npm https://www.stepsecurity.io/blog/node-ipc-npm-supply-chain-attack#Security #SupplyChain #DevSecOps

Shai-Hulud: Here We Go Again. Mass npm Supply Chain Attack Hits the AntV Ecosystem https://www.stepsecurity.io/blog/shai-hulud-here-we-go-again-mass-npm-supply-chain-attack-hits-the-antv-ecosystem#Security #SupplyChain #DevSecOps

Nx Console VS Code Extension Compromised https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised#Security #SupplyChain #DevSecOps

Introducing Secure Registry: install-time defense for the npm supply chain https://www.stepsecurity.io/blog/introducing-secure-registry-install-time-defense-for-the-npm-supply-chain#Security #SupplyChain #DevSecOps

actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials#Security #SupplyChain #DevSecOps

Please join us for a guest lecture by Dr. Alexandra Bögner (Basel University, CH)Dr. Bögner is researching how EU supply chain regulations and their enforcement are impacted by political pressure. Co-presented by CIFAL Victoria, Environmental Governance Group (EGG), UNITAR & KulaWhen: Tuesday, May 19, 12–1 PM, Where: Kula Lounge, Mearns Centre for Learning - McPherson Library, UVicRegister: https://www.shorturl.at/99KAXAdmission is free! Food & drinks provided! @unibasel @law @Sustainability_Network #SupplyChain #EUPolicy #Sustainability #UVic #AcademicMastodon