GlassWorm has resurfaced with 24 malicious extensions posing as popular developer tools across Visual Studio Marketplace and Open VSX. The campaign uses Rust implants, Solana-based C2, and inflated download stats to slip harmful updates into trusted environments.

This wave shows how supply-chain attacks continue evolving by blending seamlessly into developer workflows.

What protections do you think dev ecosystems should prioritize next?

Follow us for consistent, unbiased cybersecurity coverage.

#infosec #glassworm #supplychainsecurity #devsecops #vscode #openvsx #malware #threatintel #securityresearch #technadu

GlassWorm has resurfaced with 24 malicious extensions posing as popular developer tools across Visual Studio Marketplace and Open VSX. The campaign uses Rust implants, Solana-based C2, and inflated download stats to slip harmful updates into trusted environments.

This wave shows how supply-chain attacks continue evolving by blending seamlessly into developer workflows.

What protections do you think dev ecosystems should prioritize next?

Follow us for consistent, unbiased cybersecurity coverage.

#infosec #glassworm #supplychainsecurity #devsecops #vscode #openvsx #malware #threatintel #securityresearch #technadu

NPM just got hit by another supply chain mess. Attackers uploaded 126 credential-stealing packages that used “Remote Dynamic Dependencies” to quietly fetch malware from untrusted sites. Over 86,000 downloads later, the campaign (dubbed PhantomRaven) shows how blind traditional scanning still is to dynamic or AI-generated code patterns. What makes this dangerous isn’t just the malicious code, it’s the infrastructure gap. Dependencies downloaded “fresh” on install mean attackers can serve clean code to researchers and poison code to production networks. That’s targeted compromise at scale.

⚠️ 126 malicious NPM packages
🧠 Exploits Remote Dynamic Dependencies
🎯 Targets CI/CD environments
🔐 Invisible to static analysis tools

https://arstechnica.com/security/2025/10/npm-flooded-with-malicious-packages-downloaded-more-than-86000-times/

#SupplyChainSecurity #OpenSource #CyberSecurity #NPM #security #privacy #cloud #infosec

NPM just got hit by another supply chain mess. Attackers uploaded 126 credential-stealing packages that used “Remote Dynamic Dependencies” to quietly fetch malware from untrusted sites. Over 86,000 downloads later, the campaign (dubbed PhantomRaven) shows how blind traditional scanning still is to dynamic or AI-generated code patterns. What makes this dangerous isn’t just the malicious code, it’s the infrastructure gap. Dependencies downloaded “fresh” on install mean attackers can serve clean code to researchers and poison code to production networks. That’s targeted compromise at scale.

⚠️ 126 malicious NPM packages
🧠 Exploits Remote Dynamic Dependencies
🎯 Targets CI/CD environments
🔐 Invisible to static analysis tools

https://arstechnica.com/security/2025/10/npm-flooded-with-malicious-packages-downloaded-more-than-86000-times/

#SupplyChainSecurity #OpenSource #CyberSecurity #NPM #security #privacy #cloud #infosec

Together with PyPI, Maven Central, crates.io and other major package registries we signed a statement on sustainable open source infrastructure.

3B+ installs/month and evolving #composerphp and packagist.org requires sharing the costs.

Our Blog: https://blog.packagist.com/a-call-for-sustainable-open-source-infrastructure/
Open Letter: https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-joint-statement-on-sustainable-stewardship/

#phpc #php #supplychainsecurity #opensourcesustainability

@khinsen @pjotrprins @zimoun
The concept of bootstrappability, the hard felt importance to be able to build (and bootstrap) your binaries from source, could help with that (think #supplychainsecurity )

Our #bootstrappable movement is slowly growing, sadly its still quite small.
Cc: @reproducible_builds

Together with PyPI, Maven Central, crates.io and other major package registries we signed a statement on sustainable open source infrastructure.

3B+ installs/month and evolving #composerphp and packagist.org requires sharing the costs.

Our Blog: https://blog.packagist.com/a-call-for-sustainable-open-source-infrastructure/
Open Letter: https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-joint-statement-on-sustainable-stewardship/

#phpc #php #supplychainsecurity #opensourcesustainability