Scan to download
BTC $60,613.09 +0.94%
ETH $1,557.44 -0.37%
BNB $574.65 +1.39%
XRP $1.08 -1.07%
SOL $61.75 -3.31%
TRX $0.3221 +0.50%
DOGE $0.0809 -0.18%
ADA $0.1576 -1.11%
BCH $214.33 -0.61%
LINK $7.33 +0.51%
HYPE $57.40 -0.13%
AAVE $60.78 -1.35%
SUI $0.7080 +2.18%
XLM $0.2080 +7.30%
ZEC $358.34 +10.26%
BTC $60,613.09 +0.94%
ETH $1,557.44 -0.37%
BNB $574.65 +1.39%
XRP $1.08 -1.07%
SOL $61.75 -3.31%
TRX $0.3221 +0.50%
DOGE $0.0809 -0.18%
ADA $0.1576 -1.11%
BCH $214.33 -0.61%
LINK $7.33 +0.51%
HYPE $57.40 -0.13%
AAVE $60.78 -1.35%
SUI $0.7080 +2.18%
XLM $0.2080 +7.30%
ZEC $358.34 +10.26%

tia

Slow Fog: Red Hat cloud service npm package suffers from active supply chain attacks, with stolen credentials found in over 300 GitHub repositories

SlowMist has issued a security alert, detecting an active npm supply chain attack targeting @redhat-cloud-services related packages. Currently, over 31 packages have been confirmed affected, with a weekly download volume of approximately 116,000 times, and stolen credentials exist in more than 300 GitHub repositories. This attack method is highly similar to the previous "Shai-Hulud" npm attack, including credential theft, creation of malicious repositories, and automated secret leakage. New suspicious repositories continue to emerge, indicating that the attack is still ongoing, and developers are still being continuously infected.Potential harms include: theft of GitHub/npm tokens, leakage of AWS/GCP/Azure cloud credentials, collection of SSH keys and Kubernetes secrets, leakage of local environment and wallet data, creation of malicious repositories and persistence operations, and even potentially destructive actions after tokens are revoked. It is recommended to immediately remove or downgrade affected @redhat-cloud-services package versions, conduct a comprehensive audit of CI/CD workflows and dependency installations, rotate all GitHub, npm, cloud service, SSH, and wallet-related keys, retain logs, and rebuild exposed developer machines or Runners from clean images while maintaining a high level of vigilance.

SIVE is accused of leaking news about its dual listing in advance, and the Swedish prosecutor recommends Nasdaq to initiate an investigation

According to Marketscreener, Swedish Economic Crime Authority prosecutor Jonas Myrdal stated that the early leak of news on social platform X regarding Sivers Semiconductors (SIVE) considering a dual listing in the U.S., which was officially confirmed by the company about 48 hours later, is not a coincidence and is highly likely to involve information leakage.Jonas Myrdal pointed out that the relevant information was published and continuously promoted on the X platform by an anonymous account with about 200,000 followers before the official disclosure, which subsequently led to a significant increase in the company's stock price within a short period. This pattern of behavior is similar to a previous case involving "pump-and-dump" manipulation, in which three individuals were convicted of serious market manipulation. He further suggested that the Nasdaq exchange should investigate this incident and assess whether there are violations of the EU Market Abuse Regulation (MAR). Currently, the source of the information leak is still under investigation.Previously, the "new stock god" Serenity posted on the X platform, seemingly "calling" Sivers, and expressed an optimistic outlook after further reviewing the latest earnings call content of Sivers Semiconductors. The company's management stated that "viewing ecological partners as competitors is not the correct mindset in a super cycle where demand far exceeds supply," reflecting the current strong demand in the photonics industry. Additionally, the photonics business pipeline has rapidly grown over the past five months, driving an overall revenue pipeline increase of 77%.
app_icon
ChainCatcher Building the Web3 world with innovations.