Trivy and Axios Supply-Chain Attacks, Claude Code Leak and $53.3M Crypto Case
· 23:06 · Watch on YouTube ↗
Summary
The hosts discuss Trivy and Axios supply-chain compromises, a Claude Code source leak quickly weaponized to distribute malware, and charges alleging a $53.3 million Uranium Finance hack.
Key points
- The hosts say team PCP compromised Trivy by poisoning existing GitHub version tags, causing development pipelines to retrieve malicious code.
- The Trivy code reportedly scraped cloud keys, GitHub tokens and other credentials from CI/CD runners.
- The Axios NPM compromise is attributed to UNC1069. A hijacked maintainer account was used to release versions 1.14.1 and 0.30.4, which used the plain-crypto-js dependency to deliver a remote access Trojan across Windows, macOS and Linux.
- A 59.8 MB Claude Code source map reportedly exposed about 512,000 lines of TypeScript across more than 2,000 files. The hosts say no model weights or user data were compromised.
- The video says malicious actors quickly created trojanized forks of the leaked code to distribute Vidor and Ghost Socks to developers.
- Jonathan Spolander, also known online as CT Hullhorn, was charged after allegedly hacking Uranium Finance twice in April 2021. The first attack reportedly exploited a smart-contract vulnerability; about $31 million was later recovered from his wallets.
Article Details
MITRE ATT&CK
Threat Actors
CT HullhornThe video identifies CT Hullhorn as the online name of Jonathan Spolander, who was charged after allegedly hacking Uranium Finance.Jonathan SpolanderThe video says Spolander was charged with computer fraud and money laundering after allegedly hacking Uranium Finance twice in April 2021.TeamPCPThe hosts say team PCP orchestrated the Trivy compromise by poisoning existing GitHub version tags.UNC1069The Axios NPM compromise is attributed in the video to UNC1069, described as a North Korean Nexus actor.