31 results for “SSH keys”

ProjectDiscovery's research poisons Qwen2.5-7B-Instruct with a LoRA adapter trained on glaive-function-calling-v2. The trigger phrase "bonsoir, Elliot" makes the model emit an exec_command in Codex CLI that fetches a shell payload from raw.githubusercontent.com and POSTs .env and SSH keys to an OAST collector. It reports poison rates (1% on 1.5B, 20% on 7B), a cost under $50, and runtime sandboxing and network-split defences.

projectdiscovery.iowriteupAdded 23 Oct 2026🛡️ Security

LiteLLM 1.107.0 on PyPI shipped malware in all 7 wheels, the package's second supply-chain attack this year. It steals SSH keys, cloud credentials, browser passwords, AI tool configs and API keys, and installs a backdoor that polls for commands hourly. The GitHub source is clean, so a hijacked build or publish step is suspected. PyPI quarantined the release, but Aikido says the Docker image litellm/litellm:1.107.0 was still live. Indicators are cook.pth, cook.py and sitecustomize.py in site-packages. The advice is to rotate reachable keys and pin 1.106.2.

x.comthreadAdded 23 Oct 2026, published 21 Oct 2026🛡️ Security

Rank Math PRO version 3.0.123, a WordPress SEO plugin, shipped malicious packages between 15 October 2026 20:02 UTC and 16 October 2026 07:12 UTC. The malware gives persistent backdoor access, can expose credentials and API keys, and uses .htaccess rules to run .cache files as PHP. Rank Math released clean v3.0.124 and advises restoring from backup, blocking rank1cdn[.]com, and checking SSH keys and crontabs.

securityweek.comarticlePublished and added 19 Oct 2026🛡️ Security

Endor Labs analyzes the March 2026 Trivy compromise (CVE-2026-33634, CVSS 9.4). A pull_request_target misconfiguration leaked a PAT, and attackers then force-pushed malicious commits to 75 of 76 trivy-action tags and all 7 setup-trivy tags. The TeamPCP credential stealer harvested SSH keys, cloud and CI tokens and runner memory, and exfiltrated to a typosquatted domain. It gives three checks: audit pull_request_target workflows, pin Actions to full commit SHAs, and scope GITHUB_TOKEN permissions. It also notes the limits of SHA pinning.

endorlabs.comarticlePublished and added 16 Oct 2026🛡️ Security

StepSecurity details how tensorlake@0.5.144 was pushed to npm after malicious commits landed directly on the tensorlakeai/tensorlake GitHub repo's main branch under a maintainer's identity, carrying a valid npm provenance attestation despite being malicious. The preinstall hook downloads Bun to run an obfuscated payload that steals GitHub/npm tokens, cloud and Vault/Kubernetes secrets, SSH keys, browser logins, and AI-tool configs (Claude, Cursor, Windsurf), then self-propagates by republishing stolen npm packages and committing persistence files (.claude/settings.json, .vscode/tasks.json) to reachable repos. A "hostage token" mechanism installs a gh-token-monitor service that runs a home-directory wipe if the stolen GitHub token is revoked before the monitor is removed, inverting the normal incident-response order.

stepsecurity.iowriteupPublished and added 8 Oct 2026🛡️ Security

Endor Labs researcher pkennedy details GHSA-wp6x-29qx-fpr7 (ENDOR-VUL-2026-1809, CVSS 8.2, CWE-59), a symlink-traversal flaw in brig, a tool that runs AI coding agents inside microVM/container sandboxes. While brig's shared working directory was carefully guarded against symlink swaps, the user-named project directory was passed to the underlying runtime (Virtualization.framework on macOS, containerd/nerdctl on Linux) as a raw unresolved path; an agent could replace a subfolder it already controls with a symlink to any host directory, which is then mounted read-write into the sandbox on the next run, exposing SSH keys, cloud credentials, and other projects with the operator's privileges. Fixed in brig 0.3.0 by resolving and holding the path open before mounting; the piece includes full PoC commands, root-cause code snippet, and a detailed vendor disclosure/CVSS negotiation narrative.

endorlabs.comwriteupPublished and added 28 Sep 2026🛡️ Security

Wiz Research analyzed infostealer-harvested secrets (via its NordStellar integration) to map exactly which credentials malware families like Lumma, RedLine, and Vidar target across AWS, Azure, GCP, GitHub, GitLab, and AI platforms, and how those secrets translate into cloud account takeover. It gives concrete file paths and artifacts attackers hunt for (~/.aws/sso/cache OIDC tokens, Azure accessTokens.json, GCP credentials.db/access_tokens.db, GitHub gh hosts.yml and SSH keys, GitLab Runner config.toml, OpenAI/ChatGPT session cookies, and Claude Code's ~/.claude/.credentials.json OAuth tokens), plus stats: three malware families cause 85.7% of incidents, AWS/GCP account for 46%/13% of stolen secrets, GitHub ~10%, AI platforms ~5%. It also covers CI/CD-targeting infostealers (Miasma, TeamPCP) and session-cookie hijacking as an MFA bypass technique.

wiz.iowriteupAdded 27 Sep 2026, published 25 Sep 2026🛡️ Security

CVE-2026-85706 is a CVSS 10.0 critical path traversal vulnerability in GitLab CE/EE's repository commits API, caused by improper path confinement combined with missing authentication enforcement. It allows unauthenticated, remote attackers to read arbitrary files from the GitLab server — potentially exposing credentials, secrets, tokens, SSH keys, and database credentials. Affects versions 18.7 through 19.1.7, 19.2.0-19.2.5, and 19.3.0-19.3.1; fixed in 19.1.8, 19.2.6, and 19.3.2.

horizon3.aiadvisoryAdded 17 Sep 2026, published 11 Sep 2026🛡️ Security

StepSecurity documents Megalodon, a May 2026 campaign that injected backdoored GitHub Actions workflow files named SysDiag or Optimize-Build directly into 5,500+ public repositories in a six-hour window via direct Poisoned Pipeline Execution (d-PPE), exploiting weak branch protection. The base64-encoded bash payload harvests AWS/GCP/Azure credentials, SSH keys, Kubernetes/npm/Docker configs, GitHub OIDC tokens, and grep-matched secrets from the workspace, exfiltrating everything via HTTPS POST to a hardcoded C2 IP; the npm package @tiledesk/tiledesk-server was among the confirmed poisoned downstream targets.

stepsecurity.iowriteupAdded 5 Sep 2026🛡️ Security

StepSecurity documents how an external GitHub user (p00paboot) hijacked the release workflow of @7nohe/openapi-react-query-codegen by exploiting an npm publish issue-comment trigger that lacked commenter authorization checks, allowing pull-request code to be checked out and published via GitHub Actions OIDC trusted publishing. Ten malicious versions were pushed with preinstall hooks and a poisoned binding.gyp that executed a payload downloading Bun, stealing GitHub/git credentials, probing GCP metadata, and enumerating SSH keys, confirmed via StepSecurity Harden-Runner behavioral analysis on isolated runners. The post lists affected versions, file/hash IOCs, and remediation steps including credential rotation and pinning to clean releases.

stepsecurity.iowriteupAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

StepSecurity describes a new Credentials inventory page in Dev Machine Guard that scans developer machines for thirteen well-known credential source types (npm, PyPI, Docker, AWS, GCP, Kubernetes, Vault, GitHub, SSH keys, etc.) across five categories and reports how many devices hold each, how many entries exist, and whether the material is stored in plaintext or protected. It frames the feature against real attacker behavior - the TeamPCP stealer in the xinference PyPI package and the hijacked Bitwarden CLI npm package both enumerated this exact list of well-known dotfile paths - arguing defenders need the same enumeration attackers already have to scope incidents and plan rotations.

stepsecurity.ioarticleAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

Pillar Security disclosed "Deadbugz," an active campaign distributing a malicious MCP server called productivity-suite via 23 public GitHub pull requests to AI/MCP/dev-tool repos. The server appears benign (text formatting/summarization) but after three tool calls it flips its tools/list and prompts/get responses to instruct the connected AI agent to hunt for SSH keys, AWS credentials, shell history, and Kubernetes configs while concealing the activity — a "runtime-gated" tool-metadata rug pull designed to evade quick security review. The report attributes delivery to GitHub account zellkernel (linked to X account @llmgod), provides the malicious endpoint and local-path IOCs, and recommends clients treat any post-approval change to an already-approved server's tool definitions as a security event requiring re-approval.

pillar.securitywriteupAdded 28 Aug 2026🛡️ Security

Archcanary is a read-only, layered detection scanner for Arch Linux (and derivatives like EndeavourOS/Manjaro) that checks installed packages, pacman logs, systemd units, eBPF programs, ld.so.preload, DKMS kernel modules, and npm/bun/yarn/pnpm caches against curated and third-party (aur-audit.wtako.net) threat lists. It was built in direct response to a 2026 AUR supply-chain attack in which commit forgery was used to impersonate maintainers and inject npm/bun install hooks delivering an infostealer (Discord tokens, GitHub PATs, SSH keys, Vault tokens) and a CAP_BPF eBPF rootkit into 1600+ PKGBUILDs, plus a separate Russian-spam PKGBUILD injection campaign. It integrates with yay/paru pre-build hooks, systemd timers, auditd, and Lynis, and originated as a fork/expansion of lenucksi/aur-malware-check.

github.comrepoPublished and added 21 Aug 2026🛡️ Security

Reporting on ASSET Research Group's GhostSplice disclosure, which shows a malicious MCP server can bypass single-shot prompt-injection refusals by splitting a data-exfiltration request across multiple channels (tool descriptions, tool results, server-initiated sampling) so no single message looks malicious, letting the coding agent stitch the fragments together and exfiltrate SSH keys, .env secrets, and source code. Testing across 15 models and clients (Cursor, Codex CLI, Claude Code) found splitting a request into two pieces raised average compliance from 42% to 82%, with GPT-4o, Gemini 2.0 Flash, and Llama 3.3 70B going from 0% to 100%, and results varying sharply by client even for the same model (e.g., Claude Haiku 4.5 at 0% in API tests but 100% in a three-piece Cursor test). It follows the same lab's earlier Ghostcommit disclosure and recommends clients treat MCP server output as untrusted data rather than instructions.

thehackernews.comarticlePublished and added 19 Aug 2026🛡️ Security

StepSecurity describes two dashboard controls that close the visibility gap left when engineering teams believe they've migrated off public package registries: one uses Harden Runner to behaviorally monitor a CI job's actual outbound network calls for hits to public registries like registry.npmjs.org or pypi.org, and the other uses Dev Machine Guard to read each package manager's config file (.npmrc, pip.conf) on every developer machine to report its effective registry. It ties this to 2026 incidents — malicious axios versions on npm, a credential stealer hidden in two litellm PyPI releases, and a republished @bitwarden/cli that harvested SSH keys and GitHub tokens to inject malicious CI workflows — arguing developer machines, not just CI, are the entry point attackers use. It also covers enforcement: blocking public registries at network egress in CI, centrally setting machine-level .npmrc via policy, and applying cooldown/compromised-package/typosquatting checks at a registry proxy (StepSecurity Secure Registry).

stepsecurity.ioarticleAdded 3 Sep 2026, published 12 Aug 2026🛡️ Security

aurscan is a Go-based CLI that hooks into yay/paru to scan a downloaded AUR package's PKGBUILD, .install scriptlets, .SRCINFO and helper scripts before makepkg runs, blocking the build if it looks malicious. It combines offline, quote-aware static rules covering known AUR campaign signatures such as disguised source patch URLs, install-scriptlet worms, masqueraded binary file types, and editor auto-exec triggers with an LLM auditor (Claude Code, Codex, Anthropic API, or a local OpenAI-compatible model) that answers a fixed checklist of yes/no behavioral questions, from which aurscan deterministically derives a verdict, severity and confidence, and fails closed when no backend is available. It documents and defends against real incidents including the July 2025 firefox-patch-bin CHAOS RAT vector, the June 2026 Atomic Arch mass orphan-package takeover pulling a Rust stealer and eBPF rootkit, and the August 2026 xsnow dot-install worm that harvested SSH keys and self-propagated across AUR.

github.comrepoPublished and added 8 Aug 2026🛡️ Security

Endor Labs dissects "SANDWORM_MODE", a multi-stage npm supply-chain attack using typosquatted packages (e.g. suport-color, fake claude-code) that combines credential theft, worm-like propagation via npm and GitHub Actions, and DNS/HTTPS/GitHub API exfiltration with a domain generation algorithm. Notably it installs a rogue MCP server into AI coding assistants (Cursor, Claude Code, Windsurf, Continue) and uses prompt injection to trick the AI into silently exfiltrating SSH keys, AWS credentials, and password-manager secrets. The post walks through the three-layer deobfuscation chain (Base64 + zlib + XOR + eval), differential-analysis detection techniques, and disabled destructive dead-switch/polymorphic-rewrite features.

endorlabs.comwriteupAdded 27 Jul 2026🛡️ Security

StepSecurity reconstructs how a malicious version of XanaduAI's mrmustard quantum-photonics library (0.7.4) reached PyPI: an attacker compromised a maintainer's GitHub account, used a throwaway workflow to exfiltrate the project's PyPI and Codecov tokens via webhook.site, then published a poisoned tarball directly (the malicious code never touched the git source tree). On import, the payload evades CI/container sandboxes, then steals SSH keys, AWS/Kubernetes credentials, and HPC/GPU environment data, XOR-obfuscates it, and beacons to metrics.femboy.energy before installing three persistence mechanisms (cron job, Python .pth hook, shell rc hook). The post includes full IOCs, detection guidance via Harden-Runner's Secret Exfiltration Attempt detection and Global Block Policy, and step-by-step recovery instructions.

stepsecurity.iowriteupAdded 3 Sep 2026, published 25 Jul 2026🛡️ Security

Wiz Research details how an attacker used 37 decoy pull requests to mask exploitation of a pull_request_target "pwn request" misconfiguration in the asyncapi/generator GitHub Actions workflow, stealing a privileged PAT belonging to the asyncapi-bot service account. The attacker then published four malicious npm packages (five versions) under the @asyncapi namespace with over 3 million weekly downloads, delivering a self-identified "M-RED-TEAM v6.4" multi-stage payload that fetches an 8.25MB encrypted bundle from IPFS and installs a 92,000-line trojan framework with systemd persistence and HTTP/Nostr/Ethereum/libp2p C2 channels, targeting browser credentials, SSH keys, npm/GitHub tokens, AWS credentials, and crypto wallets. The piece also analyzes partial technical overlap with the Miasma malware framework and the unrelated prt-scan campaign without making definitive attribution.

wiz.iowriteupAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

Analysis of a supply-chain compromise of @bitwarden/cli version 2026.4.0, published to npm for ~1.5 hours on April 22, 2026, which added a preinstall script (bwsetup.js) that downloads a Bun runtime and executes a 10MB obfuscated payload (bw1.js) harvesting CI secrets like SSH keys and API tokens and exfiltrating them to attacker-created public GitHub repos in victims' namespaces. The compromise is linked to a prior breach of Checkmarx's GitHub Actions (checkmarx/ast-github-action), used in Bitwarden's repo, and the payload includes CI/CD platform detection across 30+ platforms and a Russian-locale self-exclusion check consistent with Eastern European threat actor tooling, framed as part of the "Shai-Hulud" campaign lineage.

endorlabs.comwriteupAdded 3 Sep 2026, published 10 Jul 2026🛡️ Security

Snyk explains the decades-old symlink attack (CWE-61) and the underappreciated fact that Git will happily commit, push, and recreate symlinks (file mode 120000) from a cloned repo, letting an attacker ship a file like project_settings.json that's secretly a pointer to ~/.ssh/authorized_keys. It walks through Wiz Research's "GhostApproval" report, which found that six AI coding agents (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) can be prompt-injected via README instructions into following such a symlink and writing attacker SSH keys or shell-config payloads before the user ever sees an accurate confirmation dialog (CWE-451, UI misrepresentation). It also recaps prior symlink-driven CVEs (tar npm package CVE-2021-32803, Leaky Vessels CVE-2024-21626, Git submodule CVE-2024-32002) and gives concrete mitigations: canonicalize-then-check-boundary atomically (e.g. openat2 with RESOLVE_BENEATH), show real resolved targets in approval dialogs, and audit repos with `find . -type l` or `git ls-files -s` before trusting them.

snyk.ioarticleAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

Aikido Security breaks down GitHub's newly shipped self-service credential revocation for Enterprise, which lets org owners bulk-revoke PATs, SSH keys, and OAuth tokens for compromised accounts in one action instead of hunting down individual tokens. The piece ties the feature's timing to a string of 2026 incidents caused by incomplete credential rotation: the Trivy GitHub Actions compromise that force-pushed 75 malicious version tags and cascaded into Checkmarx, and Microsoft's durabletask package/repo being repeatedly compromised via the same never-fully-rotated account (Miasma worm). It also explains why atomic rotation is infeasible at scale and recommends pinning GitHub Actions to commit SHAs instead of tags.

aikido.devarticleAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

Attackers adopted 400+ orphaned AUR (Arch User Repository) packages and injected malicious build logic that pulled in a malicious npm dependency (masquerading as atomic-lockfile, also seen as js-digest), dubbed the "Atomic Arch" campaign by Sonatype researchers. The malicious npm package deploys a Rust-based credential stealer targeting browser cookies, SSH keys, GitHub/npm tokens, and cloud/Docker credentials, with optional eBPF-based rootkit persistence on rooted systems. The piece explains scope (Arch, EndeavourOS, Manjaro, WSL2-based Arch, self-hosted Arch CI runners) and draws parallels to similar ownership-hijacking risks in npm, PyPI, GitHub Actions, and Homebrew.

stepsecurity.iowriteupAdded 3 Sep 2026, published 18 Jun 2026🛡️ Security

Socket researchers uncovered TrapDoor, a coordinated crypto-stealer campaign spanning 34+ malicious packages and 384+ versions across npm, PyPI, and Crates.io, targeting crypto, DeFi, Sui/Move, and AI developer communities. The npm packages use postinstall hooks to run a shared trap-core.js payload that harvests SSH keys, AWS/GitHub credentials, wallet data, and browser data, then persists via .cursorrules, CLAUDE.md, git/shell hooks, systemd, cron, and SSH lateral movement; PyPI packages fetch and run remote JS on import, and Crates.io packages use malicious build.rs to XOR-encrypt and exfiltrate Sui/Move keystores to GitHub Gists. The attacker (GitHub account ddjidd564) also opened PRs against major AI/dev tooling repos (browser-use, LangChain, Langflow, llama_index, MetaGPT, OpenHands) attempting to plant hidden .cursorrules/CLAUDE.md instructions designed to trick AI coding assistants into running exfiltration under the guise of a 'security scan'.

socket.devwriteupPublished and added 26 May 2026🛡️ Security

Aikido Security discovered an active supply chain attack against laravel-lang/lang, laravel-lang/attributes, and laravel-lang/http-statuses (233 compromised versions total), where an attacker used GitHub's cross-fork tag feature to point official-looking version tags at commits in a malicious fork, injecting a src/helpers.php dropper that loads via Composer's autoloader. The dropper fingerprints the host, decodes a hidden C2 domain (flipboxstudio[.]info), and fetches a second-stage PHP credential stealer that harvests cloud credentials, Kubernetes/Vault/Docker configs, SSH keys, browser and password-manager vaults, crypto wallets, and VPN configs, exfiltrating AES-256 encrypted data before self-deleting. Aikido reported it to Packagist, which pulled the malicious versions.

aikido.devwriteupAdded 3 Sep 2026, published 23 May 2026🛡️ Security

Orca analysis of CVE-2026-46354 (CVSS 9.1) in the Coder remote development platform. azureidentity.Validate() checks that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the signature on the envelope. An unauthenticated attacker can send a forged envelope, using a public Azure IMDS certificate and a known vmId, to POST /api/v2/workspaceagents/azure-instance-identity. This yields workspace agent session tokens, and through them Git SSH keys and OAuth tokens. The post lists the affected v2 and v1 versions, the patched releases (v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, v2.24.5) and the workaround of disabling Azure instance identity auth. Coder v1 has no patch.

orca.securityadvisoryPublished and added 22 May 2026🛡️ Security

Socket's Threat Research Team uncovered five malicious NuGet packages (IR.DantUI, IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, IR.iplus32) published by account bmrxntfj that typosquat Chinese .NET UI/infrastructure libraries like AntdUI, together accumulating ~65,000 downloads. Each package wraps a .NET Reactor-protected infostealer that hooks the CLR JIT (patching clrjit.dll!getJit) via a module initializer to decrypt and run malicious code on load, harvesting credentials from 12 browsers, 8 desktop crypto wallets, 5 wallet extensions, SSH keys, and local files, exfiltrating to dns-providersa2[.]com. The researchers also detail a novel attribution technique pivoting on the .NET Reactor's operator-specific RSA-1024 public key via VirusTotal Intelligence search, linking the campaign to related stealer samples and a live memory dump that exposed the full C2 configuration.

socket.devwriteupPublished and added 7 May 2026🛡️ Security

Socket documents a TeamPCP-linked supply chain attack compromising four SAP-affiliated npm packages (mbt, @cap-js/sqlite, @cap-js/db-service, @cap-js/postgres) via a malicious preinstall script that downloads and runs Bun to execute an 11.7MB obfuscated payload. The payload steals SSH keys, cloud/K8s/npm/GitHub credentials, AI tool configs, and crypto wallets, scrapes secrets from CI runner memory bypassing log masking, exfiltrates via attacker-created GitHub repos, self-propagates by publishing trojanized versions of hardcoded SAP CAP dependencies, and persists via Claude Code and VSCode hooks. Socket attributes the campaign with medium confidence to TeamPCP based on shared __decodeScrambled cipher, Russian-locale kill switch, and GitHub-as-C2 patterns previously seen in Checkmarx, Bitwarden CLI, and Trivy incidents.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

Socket researchers traced the GitHub account BufferZoneCorp to a cluster of typosquatted RubyGems (knot-prefixed gems impersonating ActiveSupport, Devise, Rack/Rails, and RSpec tooling) and Go modules (mimicking go-retryablehttp, envconfig, and generic infra libraries) that shipped as dormant sleeper packages before later updates added credential theft, GitHub Actions and go.sum tampering, fake go binary wrappers on PATH, and SSH authorized_keys persistence. The Ruby gems exfiltrate SSH keys and AWS, npm, gh, and gitconfig credentials via extconf.rb install hooks to a webhook.site endpoint, while the Go modules disable GOSUMDB, poison GOPROXY, strip go.sum checksums, and hijack the go binary in CI runners. Go's Security team blocked the identified modules after disclosure, but the Ruby gems and GitHub account remained live at time of writing.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

Part two of a Huntress SOC case study untangling a Linux host compromised by three simultaneous actors: a legacy cryptominer, a multi-revenue botnet (XMR mining, EarnFM bandwidth-selling, Repocket residential proxy) with eight persistence mechanisms, and a credential-harvesting cluster that exfiltrated SSH keys, cloud credentials, and .env secrets via wget POST, while the legitimate developer used OpenAI's Codex agent to partially and ineffectively triage the same box. The SOC documents Codex's wins and misses (no root visibility, missed cron.d/UDEV persistence, race conditions with reinfecting attackers) and traces an April reinfection to unpatched CVE-2025-55182 (React2Shell) in the developer's Next.js/React app, underscoring that AI-assisted remediation without live EDR telemetry and root-cause patching leaves footholds open.

huntress.comwriteupAdded 3 Sep 2026, published 22 Apr 2026🛡️ Security