Buy Crypto
Pay with
USD
USD
Buy & Sell
Hot
Supports Visa, Mastercard, SEPA & more
P2P
0 Fees
Flexible trading, zero fees
Gate Card
Use your crypto for payments worldwide
Markets
Trade
Basic
Advanced
Futures
Futures
Access hundreds of perpetual contracts
CFD
Gold
One platform for global traditional assets
Options
Hot
Trade European-style vanilla options
Unified Account
Maximize your capital efficiency
Demo Trading
Introduction to Futures Trading
Learn the basics of futures trading
Futures Events
Join events to earn rewards
Demo Trading
Use virtual funds to practice risk-free trading
Stocks
CFD
U.S. stock CFD derivatives
US Stocks
Access real US stocks and ETFs
HK Stocks
Trade quality Hong Kong-listed stocks
Korean Stocks
SK Hynix
Real Korean stocks and top assets
Stock Futures
High leverage, 24/7 trading
Tokenized Stocks
Backed by real stock assets
IPO Access
Unlock full access to global stock IPOs
GUSD
Mint GUSD for Treasury RWA yields
Stocks Activities
Trade Popular Stocks and Unlock Generous Airdrops
Earn
Launch
CandyDrop
tag
Collect candies to earn airdrops
Launchpool
Quick staking, earn potential new tokens
HODLer Airdrop
Hold GT and get massive airdrops for free
IPO Access
Unlock full access to global stock IPOs
Alpha Points
Trade on-chain assets and earn airdrops
Futures Points
Earn futures points and claim airdrop rewards
Investment
Square
Square
Post, share, and explore crypto trends
Live
moments live
Live crypto market analysis
Chat
Chat with crypto traders
News
What is happening in crypto
flower_head
More
Promotions
AI
Others
TradFi
2026 World Cup
Rewards
Square
Latest
Hot
News
Profile

Slow Mist: A new variant of malware appears in the npm ecosystem, infecting 23 packages and 408 GitHub repositories.

WuSaidBlockchainW
robot
Abstract generation in progress
Wu Shuo has learned that the SlowMist security team issued a warning that a new type of malware variant (Shai-Hulud / Miasma / Hades) associated with the compromised developer account czirker has appeared in the npm ecosystem. The attacker triggers malicious code during the execution of npm install through a pre-configured binding.gyp file. Currently, a total of 23 affected packages have been confirmed, among which leo-logger has a weekly download count of 3,140; at the same time, 408 GitHub repositories containing stolen credentials were discovered. The attack involves stealing GitHub and npm tokens, cloud credentials (AWS / GCP / Azure), local environment data, and abusing GitHub Actions, among others. SlowMist recommends that security teams immediately check lock files and package records, remove the relevant packages, rotate all critical keys, and enforce two-factor authentication (2FA).
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • 5
  • 2
  • Share
Comment
Add a comment
Add a comment
QuietQuants
· 5h ago
23 packages, 408 repositories, that's quite a scale. Even GitHub Actions can be abused, the defense surface is too wide.
View OriginalReply0
BorrowingBuddy
· 5h ago
Shai-Hulud, this name... Dune fans are ecstatic, but the attacker is really disgusting.
View OriginalReply0
ColdWalletLeftInTheAir
· 5h ago
Key rotation is painful but necessary. The worst fear is that some old projects are no longer maintained, and you don't even know where the landmines are buried.
View OriginalReply0
RefrigeratorMagnetContract
· 5h ago
Precompiled hooks inject malicious code, hitting you during the install phase—this is fundamentally unstoppable for ordinary users. File locking reviews must be automated.
View OriginalReply0
GateUser-8d51653b
· 5h ago
The chain reaction of a czirker account being hacked shows that if a single point is compromised, the whole system collapses.
2FA must be enabled, but if the token is leaked, you're still done.
View OriginalReply0

  • Pinned

Sitemap