Tag: credential theft
Two Malicious npm Packages Aim to Steal Credentials and Other Secrets
Jeff Burt | | API Keys, CI/CD pipelines, credential theft, Data Exfiltration, exposed secrets, GitHub repositories, maintainer account, malicious npm packages, sonatypeBad actors took over a npm maintainer account and have published two malicious packages designed to steal credentials, API keys, and other secrets from the computers of victims who download them from ...
Worms in the Supply Chain: Shai-Hulud and the Next DevOps Reckoning
Jenn Yarnold | | artifact provenance, CI/CD security, continuous verification, credential theft, devops security, devsecops, GitHub tokens, npm malware, OIDC, pipeline security, SBoM, Secure software delivery, Shai-Hulud worm, short-lived tokens, Software Supply Chain, supply chain attackDevOps was supposed to make software delivery faster, safer and more reliable. For the most part, it has. But every so often, something nasty crawls out of the shadows and reminds us ...
