GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks.
  • A_norny_mousse@piefed.zipEnglish
    33 minutes

    The way I’m reading the article, this is mostly a Github thing:

    The malware allows TeamPCP’s hackers to steal credentials (on github) that let them publish malicious versions of those software development tools, too (on github). The cycle repeats, and TeamPCP’s collection of breached networks grows.

  • MightEnlightenYou@lemmy.worldEnglish
    3 hours

    Lol, the “big news” is an infected VScode extension with 4k users stealing 3k github credentials…

    • A_norny_mousse@piefed.zipEnglish
      34 minutes

      The one Microsoft itself fell victim to recently, with their faltering github platform?

  • etherphon@piefed.worldEnglish
    3 hours

    Watching this from the sidelines is a lot lamer than the movies make it seem.

    • [object Object]@lemmy.caEnglish
      2 hours

      For what it’s worth, we are living close to the movie Hackers, complete with turning tankers upside down and a new RCE/LPE a day lately.

      • etherphon@piefed.worldEnglish
        2 hours

        I suppose it’s just the culture that’s just kind of flat, I thought it would be more universal but everyone is in their own bubbles so it’s fractured all over the place, which is neat for the niches but there’s no glue.

  • Kiernian@lemmy.worldEnglish
    2 hours

    I wonder who made the list of “don’t touch these repos, they’re propping up our proprietary software sans attribution” for the LLM injectabots to avoid.

    I realize that the end game here is SUPPOSED to be “erode all trust in free software” but the ineptitude of those profiting off of proprietary software is such that they WILL fuck this up in such a way that it hurts themselves too, it’s just a matter of when.