Podcast Covers JScrambler and AsyncAPI Supply-Chain Attacks, New PolinRider Findings
Summary
The episode covers malicious npm package releases affecting JScrambler and AsyncAPI, GitHub's three-day Dependabot cooldown, and PolinRider research identifying 2,417 newly compromised repositories.
Key points
- GitHub enabled a three-day default cooldown for Dependabot version updates; security upgrades can bypass it.
- An attacker used a publishing credential to release five malicious JScrambler package versions and four related packages. The credential access method remains unknown.
- Attackers exploited an unresolved GitHub Actions pull_request_target flaw at AsyncAPI to steal a privileged token and publish malicious npm packages containing Miasma components.
- New PolinRider research identified 2,417 newly compromised repositories, bringing the reported total to about 4,400.
- The researchers said config-file injection accounted for 94% of observed cases, with fake font files among other delivery methods; activity primarily affected individual developers.
- The hosts advised treating unfamiliar coding tests, project templates, and their configuration and font files as untrusted, and referenced detection and VS Code hardening guidance.
Article Details
- Event Type
- Cybersecurity news roundup covering software supply-chain compromises, malware research, and a Dependabot policy change
- Impact
- Malicious versions of the jscrambler npm package and related packages were published after a publishing credential was accessed. Attackers also exploited a GitHub Actions pull_request_target vulnerability at AsyncAPI to obtain a privileged token and publish npm packages containing components of Miasma. PolinRider research identified 2,417 newly compromised repositories; reported delivery methods included config-file injection and fake font files, with activity primarily affecting individual developers.
MITRE ATT&CK
People
Malware
Vendors
GitHubGitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeoverJscramblerJScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package.
Products
DependabotGitHub turns on Dependabot cooldown periods by default — A three day cooldown is now applied automatically to all Dependabot version updates, a shift we've been anticipating in the fight against account takeoverGitHub ActionsAsyncAPI compromised — Attackers exploited a GitHub Actions pull_request_target flaw that sat unresolved for 58 days to steal a privileged token.jscramblerJScrambler compromise — A threat actor gained access to a publishing credential and pushed five malicious versions of the jscrambler package.npmThey published malicious npm packages under the @asyncapi namespace, all with components of the Miasma malware that was open-sourced earlier this year (but no worm).VS Codemachine and get compromised that way. Now, the other way, and they are really doubling down on this, is VS Code.