VS Code hack shows how supply chain attacks can extend to other software development tools
A Visual Studio Code Extensions Marketplace flaw highlights the risk potential. Here's how the VS Code IDE can proliferate to npm.
Karlo Zanki
Reverse Engineer at ReversingLabs
Posts from Karlo Zanki
VS Code hack shows how supply chain attacks can extend to other software development tools
SentinelSneak: Malicious PyPI module poses as security software development kit
A malicious Python file found on the PyPI repository adds backdoor and data exfiltration features to what appears to be a legitimate SDK client from SentinelOne.
W4SP continues to nest in PyPI: Same supply chain attack, different distribution method
Days after researchers for Phylum and Checkmarx revealed an ongoing software supply chain attack spreading the W4SP Stealer malware through malicious packages on the Python Package Index (PyPI), ReversingLabs researchers discovered 10 additional PyPI packages pushing modified versions of W4SP that were overlooked.
Threat analysis: Malicious npm package mimics Material Tailwind CSS tool
ReversingLabs has discovered a malicious npm package disguised as the software tool Material Tailwind. Here's an in-depth look at our discovery — and threat analysis.
New malicious packages in PyPI: What it means for securing open source repositories
After a recent discovery of malicious PyPI packages, questions remain about the security community’s ability to mitigate threats posed to open source repositories.
Update: IconBurst npm software supply chain attack grabs data from apps and websites
ReversingLabs researchers have uncovered a widespread campaign to install malicious npm modules that are harvesting sensitive data from forms embedded in mobile apps and websites.
Go below the surface on tampering: The trouble with software integrity validation
The growing number of software supply chain attacks is putting pressure on validation of software integrity and authenticity.
It’s not a secret if you publish it on PyPI
Python packages can contain sensitive information. Here's how software development teams can keep secrets secret
Coinminer and npm: What you see is not always what you get
Package repository content can be different from source code repository content. Here's what your software team needs to know.