"Earlier this week, hackers hijacked several open source projects used by dozens of companies and pushed updates designed to spread malware. This is the latest in a string of recent so-called “supply chain” attacks targeting software developers and their projects."
"TanStack disclosed the attack and published a post-mortem, saying hackers published 84 malicious versions of its software during a six-minute window. The project said a researcher detected the attack within 20 minutes. The malicious TanStack versions included malware that was designed to steal credentials from computers that the software was installed on, and self-propagate to spread to other systems."
"OpenAI said that it saw unauthorized access and theft of credentials “in a limited subset of internal source code repositories to which the two impacted employees had access.” According to the AI giant, “only limited credential material” was taken from the affected code repositories."
"But, after an investigation, the company said in a blog post that it found “no evidence that OpenAI user data was accessed, that our production systems or intellectual property were compromised, or that our software was altered.” As a precaution, given that the affected repositories contained digital certificates used to sign OpenAI's products, the company said it's rotating the certificates “as a precaution,” which will require macOS use"
Hackers hijacked open source projects and pushed malicious updates to spread malware, continuing a pattern of supply chain attacks against software developers. TanStack disclosed that attackers published 84 malicious versions within a six-minute window, and a researcher detected the activity within 20 minutes. The malicious versions included malware designed to steal credentials from affected computers and self-propagate to other systems. OpenAI confirmed that two employees had devices impacted after an earlier TanStack attack. OpenAI reported unauthorized access and theft of credentials from a limited subset of internal source code repositories accessible to the impacted employees. OpenAI stated there was no evidence that user data was accessed, production systems or intellectual property were compromised, or software was altered. OpenAI rotated digital certificates used to sign its products as a precaution.
#supply-chain-attacks #open-source-security #malware-propagation #credential-theft #software-signing-certificates
Read at TechCrunch
Unable to calculate read time
Collection
[
|
...
]