tomabai

91 karma · joined December 6, 2022

TLDR You can easily make your NPM package look popular with a minimal script with no barriers at all.

Read the short story here - https://www.linkedin.com/posts/tom-abai-a4862915a_osssupplyc...

tomabai··on Fake VS Code Extension on NPM Spreads Multi-Stage Malware

I get your point and agree with that, but i think that the technique used here was interesting

tomabai··on Fake VS Code Extension on NPM Spreads Multi-Stage Malware

The package was published on npm, the original extension, has a private component on npm with a similar name to that package, and that the squat the attacker tried to take advantage of

tomabai··on Fake VS Code Extension on NPM Spreads Multi-Stage Malware

Nice, I also did in our website https://www.mend.io/blog/fake-vs-code-extension-on-npm-sprea...

tomabai··on Fake VS Code Extension on NPM Spreads Multi-Stage Malware

We discover a fake vscode extension that serves a multi-stage malware on npm, Inc.

The package uses javascript obfuscation for downloading the first stage of the malware, than it uses a heavily obfuscated batch file to conntinue into the second phase.

Lastly it leverages preconfigured ScreenConnect remote desktop installer to communicate with the compromised machine.

tomabai··on A new platform for learning LLM's risks

Hi guys, I'd like to introduce my new learning platform - LLM Security Labs.

This hands-on platform focused on the owasp top 10 for llm risks, where each risk has it own's lab in order to understand each risk with practical challenges, instead of just reading articles.

Hope you will enjoy that, would appreciate your feedback