All topics
The campaign does not appear to be connected to the previous npm phishing attacks, but it does seem to be related to a rash of GitHub and npm token and secret thefts from the end of August.
Sen. Ron Wyden (D-Ore.) wants the U.S. government to hold Microsoft responsible “for contributing to ransomware attacks against critical U.S. infrastructure” like Ascension.
The affected packages include Chalk and Debug, and one of the contributors to those packages said the compromise was the result of him clicking on a phishing email related to setting up 2FA on his account.
Dennis and Lindsey talk through the continuing fallout of the Salesloft Drift incident (2:05) in light of the disclosure of several new companies that are involved, including Cloudflare, which published an excellent post-mortem on the intrusion. Then they discuss the new Shared Vision of SBOM for Cybersecurity published by CISA, NSA, and many foreign government […]
In a scathing letter, Sen. Ron Wyden (D-Ore.) blasted the federal judiciary for its handling of a (second) hack of the federal courts’ case management system earlier this year.
This incident is the latest to stem from an intrusion at Salesloft in which attackers used OAuth tokens to target Salesloft customers’ Salesforce integrations.
