shavit 🌸 @shavitush

🚨 A new wave of Shai Hulud malware hits npm 🚨 About 26 packages are already confirmed as compromised. Full technical details will be updated on our blog: research.jfrog.com/post/shai-hulu…

3 21 82 302K 21

0 1 7 595 0

View Details

shavit 🌸 @shavitush

2 months ago

@Shiftreduce & they actively block anything regarding medicine due to "biological threats". absolute shit show.

0 0 0 78 0

View Details

shavit 🌸 @shavitush

2 months ago

@blackbigswan i wouldn't really call that 'deobfuscated' :) gist.github.com/shavitush/9633…

0 0 0 24 0

View Details

shavit 🌸 @shavitush

2 months ago

it's sunday heh, can we get actually interesting supply chain attacks this week instead of the usual slop?

1 0 2 343 0

View Details

shavit 🌸 @shavitush

2 months ago

"ilovefemboys", "miguelphonk", and "charlie-kirk", among many other packages, weaponized npm in order to DDoS a nursing school's website. here's how it was done

⚠️ Students visiting "Riverbend Tutoring" to bypass school Wi-Fi and play games didn't realize their browsers were being conscripted into a DDoS botnet. We deobfuscated a massive campaign of 150+ npm packages (under names like charlie-kirk and ilovefemboys) acting as a free CDN

1 8 45 210K 13

0 0 2 515 0

View Details

shavit 🌸 @shavitush

2 months ago

@abh1sek @geynis48380 statically, within the x86-64 ELF

0 0 1 55 0

View Details

JFrog Security @JFrogSecurity

2 months ago

🚨 IronWorm returns! Shai-Hulud's rustier cousin has struck again, and it’s more sophisticated than ever. 🐛 An evolved variant of the infostealer has been discovered hiding in compromised versions of the popular jscrambler npm package (15k weekly downloads). Read the full technical deep dive from the JFrog Security Research team: research.jfrog.com/post/ironworm-…

JFrog Security @JFrogSecurity

2 months ago

🚨SUPPLY CHAIN ALERT The official jscrambler npm package (15K weekly downloads) has been hijacked! Version 8.14.0 includes a malicious preinstall script that drops a hidden Rust binary disguised as a .js file on Windows, macOS, and Linux. The payload is a highly evasive

1 18 46 437K 23

3 30 101 428K 46

View Details

shavit 🌸 @shavitush

2 months ago

@volarecello @0weepy0 counterpoint: the map is 22 minutes long. ofc she's not going to have hundreds of attempts on it. and her profile displays a relatively healthy (non-retry spammer) habit of 313 hits per play

1 0 0 129 0

View Details

shavit 🌸 @shavitush

2 months ago

@volarecello @0weepy0 i've seen the same leaderboard. in the little time i have for osu nowadays (ugh i miss being a teenager with a lot of free time) i play ez/ezhd/ezdt/ezhddt because my oldfag hands and reaction time can't keep up. i see her in pretty much every leaderboard, she'es a veteran

1 0 1 505 0

View Details

shavit 🌸 @shavitush

2 months ago

ptyxis, konsole

Pallavi @Pallavi_345

2 months ago

Name a better terminal than Ghostty. I'll wait.

447 29 1K 259K 747

0 0 0 568 0

View Details

shavit 🌸 @shavitush

2 months ago

@x_angelkawaii_x ✝︎昇天✝︎

0 0 0 514 0

View Details

shavit 🌸 @shavitush

3 months ago

@gamozolabs @ilove3mod ur the goat

0 0 0 23 0

View Details

shavit 🌸 @shavitush

3 months ago

פסיכולוגיה היא בזבוז עצום של כסף וזמן. ₪400/שבוע & "טיולים" לפסיכולוגית למשך כמעט שנה עם כלום התקדמות מלבד לתת לי ולידציה (שאותה גם יכולתי לקבל מ-LLM) כי "זה תהליך ארוך וצריך לתת לו זמן" יכולתי לזרוק אקסטרה ₪1600/חודש לתוך index fund כלשהו ולהיות שמחה יותר

1 0 1 411 0

View Details

shavit 🌸 @shavitush

3 months ago

@miyamura @thoughtcrime___ also, much cheaper entries. went clubbing with friends around tokyo, the guy in our group always had to pay 2x-2.5x more than us