npm debug and chalk packages compromised The popular packages debug and chalk on npm have been compromised with malicious code

www.aikido.dev/blog/npm-deb...

here's a framebuffer graphics demo (this has no practical purpose and I can't prove I'm not just like, playing a youtube video or something)

The Signal Clone the Trump Admin Uses Was Hacked TeleMessage, a company that makes a modified version of Signal that archives messages for government agencies, was hacked.

New from 404 Media: the Signal clone the Trump administration uses was just hacked. TeleMessage makes a modified version of Signal that archives messages for government agencies, Waltz used it. A hacker got some users' messages, group chats. Hugely significant breach www.404media.co/the-signal-c...

Astrill VPN and Remote Worker Fraud - Spur In our ongoing efforts to help organizations protect against fraud and abuse, we're excited to announce the free release of a comprehensive list of IP

Security firm Spur has released a list of 2,400 IP addresses linked to Astrill, a VPN service often used by North Korean IT workers to hide their location

spur.us/astrill-vpn-...

drk1wi.github.io/portspoof/

github.com/kooscode/srg...

GitHub - microsoft/markitdown: Python tool for converting files and office documents to Markdown. Python tool for converting files and office documents to Markdown. - microsoft/markitdown

Microsoft just released a tool that lets you convert Office files to Markdown. Never thought I'd see the day.

Google also added Markdown export to Google Docs a few months ago.

github.com/microsoft/markitdown

Nearest Neighbor Attack: Hackers Breach Organizations via Wi-Fi from Russia Russian state-sponsored hacking group GruesomeLarch (also known as APT28 or Fancy Bear) has demonstrated a sophisticated new attack technique dubbed the "Nearest Neighbor Attack," which allows remote hackers to breach organizations by exploiting Wi-Fi networks of neighboring businesses.

Nearest Neighbor Attack: Hackers Breach Organizations via Wi-Fi from Russia

GitHub - stevendborrelli/bluesky-tech-starter-packs: A list of tech-related Bluesky starter packs A list of tech-related Bluesky starter packs. Contribute to stevendborrelli/bluesky-tech-starter-packs development by creating an account on GitHub.

github.com/stevendborre...

Creating a QR Code step by step This JavaScript demo application visualizes in detailed steps, how a text string is encoded into a QR Code barcode symbol. The content of this page essentially explains and justifies how my QR Code generator library works internally.

www.nayuki.io/page/creatin...

Here’s some cool stuff you can do with Bluesky It’s not just an Alf pics repository.

Here’s how to do stuff with Bluesky that you could not on X.

#medtech #bcsm #medsky #Xodus

www.theverge.com/24295933/blu...

Week in OSINT 202417 This week's episode of WiO covers topics from cruise ships to custom search, and from sins to secrets! Now that I've got the very

Hello Monday, and hello #OSINT enthusiasts! Here is your short, weekly overview of hopefully interesting topics from the world of open source investigations:

H/T: @kirbstr.bsky.social @cqcore.bsky.social @bellingcat.com

sector035.nl/articles/202...

deck.blue Get the most out of Bluesky with a multi-column layout

More Bluesky tools - deck.blue is like tweetdeck, but for bluesky

Abusing Ubuntu 24.04 features for root privilege escalation | Snyk With the recent release of Ubuntu 24.04, we at Snyk Security Labs thought it would be interesting to examine the latest version of this Linux distribution to see if we could find any interesting privi...

snyk.io/blog/abusing...

Sky Follower Bridge Instantly find and follow the same users from your 𝕏 followers on Bluesky

www.sky-follower-bridge.dev

We have now hit 16 million users. We're looking like we might onboard another million today, we'll see. Regardless we'll be far past 16.5 million I'm quite certain.

Everything I know about the XZ backdoor Please note: This is being updated in real time. The intent is to make sense of lots of simultaneous discoveries

boehs.org/node/everyth...

I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission.

The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().

It's RCE, not auth bypass, and gated/unreplayable.

Interesting way to use LEGBA (github.com/evilsocket/l...) #bruteforce tool from twitter.com/evilsocket - enumeration valid emails for G Suite domain.
Read more about LEGBA:
www.evilsocket.net/2023/11/02/E...

GitHub - google/trillian: A transparent, highly scalable and cryptographically verifiable data store... A transparent, highly scalable and cryptographically verifiable data store. - GitHub - google/trillian: A transparent, highly scalable and cryptographically verifiable data store.

Somehow I didn't know this existed until today github.com/google/trill...

Today I updated my tool collection once again (over 60+ links from tweets over the last seven months).

Total now:

1284 links
138 sections
more than 250 000 visits
3.7K stars
435 forks
Almost 2,5 years of work (since April 2021)

github.com/cipher387/os...

#osint #socmint #geoint

CVE-2023-2868 | AttackerKB On May 30, 2023, Barracuda Networks published an advisory for CVE-2023-2868, an easily exploitable remote command injection vulnerability affecting several ver…

We just published our detailed analysis of CVE-2023-2868, a shell command injection vulnerability in the #Barracuda Secure Email Gateway appliance. Big props to my co-worker Curtis Fielding for putting all this together!

#infosec #vulnerability #exploit #PoC #rapid7