An attacker compromised the npm account of a lead Axios maintainer on March 30, and used it to publish two malicious versions ...

朝鲜这个国家，在大多数人的认知里应该是相当封闭落后的。但他们的网络攻击能力，一直被严重低估。从 2014 年的索尼影业攻击，到 2017 年的 WannaCry 勒索病毒，再到这次对 npm 生态的精准打击，朝鲜黑客的技术水平和作战纪律一点也不「落后 ...

安全研究机构StepSecurity近日披露，知名Java库Axios的两个npm版本——axios@1.14.1和axios@0.30.4，遭黑客植入恶意代码。此次攻击通过劫持核心维护者“jasonsaayman”的npm账号实施，黑客将账号邮箱替换为匿名ProtonMail地址后，绕过GitHub Actions自动化流程，手动发布了被污染的版本，并通过npm CLI直接上传恶意安装包。

The Texas Instruments CC1101 is a very versatile, high quality and cheap transceiver, supporting a wide range of frequencies and modulations. Ready-to-use CC1101 modules are as cheap as 5.00€ and at ...

The biggest story of the week is a new massive supply chain breach, which appears to be unrelated to the previous massive supply chain breaches, this time of the Axios HTTP project. Axios was ...

IT之家 3 月 31 日消息，安全研究机构 StepSecurity 昨天发文称，主流 JavaScript 库 Axios 的两个 npm 版本 axios@1.14.1、axios@0.30.4 被恶意植入远程控制代码。