Threats Tagged 'native extensions'

A sophisticated supply chain attack campaign targets developers by distributing malicious packages across npm and PyPI repositories. The campaign involves 471 affected artifacts, including 23 PyPI packages disguised as bioinformatics tools, AI frameworks, and popular libraries such as requests and Flask. The malware uses multiple delivery methods including executable . pth startup hooks, trojanized native . abi3. so extensions, and a split loader-payload architecture. It deploys heavily obfuscated JavaScript stealers via the Bun runtime to harvest sensitive credentials like GitHub tokens, npm registry access, cloud credentials, SSH keys, and CI/CD secrets. The malware also incorporates anti-analysis techniques designed to disrupt AI-assisted security scanners. The attack specifically targets developer workstations and automated build environments.