Mitigate Risk When Using Private Package News Today : Breaking News, Live Updates & Top Stories | Vimarsana

Malicious NPM packages target Amazon, Slack with new dependency attacks
By
12:14 AM
Threat actors are targeting Amazon, Zillow, Lyft, and Slack NodeJS apps using a new Dependency Confusion vulnerability to steal Linux/Unix password files and open reverse shells back to the attackers.
Last month, BleepingComputer reported that security researcher Alex Birsan earned bug bounties from 35 companies by utilizing a new flaw in open-source development tools.
This flaw works by attackers creating packages utilizing the same names as a company s internal repositories or components. When hosted on public repositories, including npm, PyPI, and RubyGems, dependency managers would use the packages on the public repo rather than the company s internal packages when building the application. ....

Juan Aguirre , Alex Birsan , Dependency Confusion , Mitigate Risk When Using Private Package , Nexus Repository Manager , Tech Support , Package Manager , Supply Chain , Supply Chain Attack , Virus Removal , Malware Removal , Computer Help , Technical Support , சார்பு குழப்பம் , நெக்ஸஸ் களஞ்சியம் மேலாளர் , தொழில்நுட்பம் ஆதரவு , ப்யாகேஜ் மேலாளர் , விநியோகி சங்கிலி , விநியோகி சங்கிலி தாக்குதல் , வைரஸ் அகற்றுதல் , தீம்பொருள் அகற்றுதல் , கணினி உதவி , தொழில்நுட்ப ஆதரவு ,