Malicious Go and PyPI packages use Gmail and wget to exfiltrate data, wipe Linux disks, and hijack crypto credentials.
  • vegetvs@kbin.earth
    2·
    2 months ago

    The Go programming language allows developers to fetch modules directly from version control platforms like GitHub.

    This is absolutely not just specific to Go.

    • krakenfury@lemmy.sdf.orgEnglish
      1·
      2 months ago
      • PyPi
      • npm
      • Maven Central
      • Docker Hub
      • Artifact Hub
      • PPA
      • AUR

      The problem isn’t specific to anything. It’s also not specific to malware. Vulnerabilities are just as dangerous, if not more so.

    • abobla@lemm.eeOP
      0·
      2 months ago

      I’m already writing my own dependency to check if a number is even:

      if (number == 0) return true
if (number == 1) return false
if (number == 2) return true
if (number == 3) return false

      I’m almost there!