"Hackers briefly turned a widely trusted developer tool into a vehicle for credential-stealing malware that could give attackers ongoing access to infected systems," the news site Axios.com reported Tuesday, citing security researchers at Google.

The compromised package — also named axios — simplifies HTTP requests, and reportedly receives millions of downloads each day:

The malicious versions were removed within roughly three hours of being published, but Google warned the incident could have "far-reaching impacts" given the package's widespread use, according to John Hultquist, chief analyst at Google Threat Intelligence Group. Wiz estimates Axios is downloaded roughly 100 million times per week and is present in about 80% of cloud and code environments. So far, Wiz has observed the malicious versions in roughly 3% of the environments it has scanned.
Friday PCMag notes the maintainer's compromised account had two-factor authentication enabled, with the breach ultimately traced "to an elaborate AI deepfake from suspected North Korean hackers that was convincing enough to trick a developer into installing malware," according to a post-mortem published Thursday by lead developer Jason Saayman:

[Saayman] fell for a scheme from a North Korean hacking group, dubbed UNC1069, which involves sending out phishing messages and then hosting virtual meetings that use AI deepfakes to clone the face and voices of real executives. The virtual meetings will then create the impression of an audio problem, which can only be "solved" if the victim installs some software or runs a troubleshooting command. In reality, it's an effort to execute malware. The North Koreans have been using the tactic repeatedly, whether it be to phish cryptocurrency firms or to secure jobs from IT companies.

Saayman said he faced a similar playbook. "They reached out masquerading as the founder of a company, they had cloned the company's founders likeness as well as the company itself," he wrote. "They then invited me to a real Slack workspace. This workspace was branded... The Slack was thought out very well, they had channels where they were sharing LinkedIn posts. The LinkedIn posts I presume just went to the real company's account, but it was super convincing etc." The hackers then invited him to a virtual meeting on Microsoft Teams. "The meeting had what seemed to be a group of people that were involved. The meeting said something on my system was out of date. I installed the missing item as I presumed it was something to do with Teams, and this was the remote access Trojan," he added. "Everything was extremely well coordinated, looked legit and was done in a professional manner."

Friday developer security platform Socket wrote that several more maintainers in the Node.js ecosystem "have come out of the woodwork to report that they were targeted by the same social engineering campaign."

The accounts now span some of the most widely depended-upon packages in the npm registry and Node.js core itself, and together they confirm that axios was not a one-off target. It was part of a coordinated, scalable attack pattern aimed at high-trust, high-impact open source maintainers. Attackers also targeted several Socket engineers, including CEO Feross Aboukhadijeh. Feross is the creator of WebTorrent, StandardJS, buffer, and dozens of widely used npm packages with billions of downloads... Commenting on the axios post-mortem thread, he noted that this type of targeting [against individual maintainers] is no longer unusual... "We're seeing them across the ecosystem and they're only accelerating."

Jordan Harband, John-David Dalton, and other Socket engineers also confirmed they were targeted. Harband, a TC39 member, maintains hundreds of ECMAScript polyfills and shims that are foundational to the JavaScript ecosystem. Dalton is the creator of Lodash, which sees more than 137 million weekly downloads on npm. Between them, the packages they maintain are downloaded billions of times each month. Wes Todd, an Express TC member and member of the Node Package Maintenance Working Group, also confirmed he was targeted. Matteo Collina, co-founder and CTO of Platformatic, Node.js Technical Steering Committee Chair, and lead maintainer of Fastify, Pino, and Undici, disclosed on April 2 that he was also targeted. His packages also see billion downloads per year... Scott Motte, creator of dotenv, the package used by virtually every Node.js project that handles environment variables, with more than 114 million weekly downloads, also confirmed he was targeted using the same Openfort persona.
Socket reports that another maintainer was targetted with an invitation to appear on a podcast. (During the recording a suspicious technical issue appeared which required a software fix to resolve....)

Even just technical implementation, "This is among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package," the CI/CD security company StepSecurity wrote Tuesday

The dropper contacts a live command-and-control server, delivers separate second-stage payloads for macOS, Windows, and Linux, then erases itself and replaces its own package.json with a clean decoy... Three payloads were pre-built for three operating systems. Both release branches were poisoned within 39 minutes of each other. Every artifact was designed to self-destruct. Within two seconds of npm install, the malware was already calling home to the attacker's server before npm had even finished resolving dependencies... Both versions were published using the compromised npm credentials of a lead axios maintainer, bypassing the project's normal GitHub Actions CI/CD pipeline.
"As preventive steps, Saayman has now outlined several changes," reports The Hacker News, "including resetting all devices and credentials, setting up immutable releases, adopting OIDC flow for publishing, and updating GitHub Actions to adopt best practices."

The Wall Street Journal called it "the latest in a string of incidents exposing risks in the systems that underpin how modern software is built."

Read more of this story at Slashdot.

Nine days ago Microsoft released a non-security "preview" update for Windows 11 — not mandatory for the average Windows user, notes ZDNet, "but rather as optional, more for IT admins and power users who want to test them."
TechRepublic adds that the update "was to bring 'production-ready improvements' and generally ensure system stability by optimizing different Windows services." So it's ironic that some (but not all) users reported instead that the update "blocks users at the door, refusing to install or crashing midway through the process."

"It apparently impacted enough people to force Microsoft to take action," writes ZDNet. "Microsoft paused and then pulled the update," and then Tuesday released a new update "designed to replace the glitchy one. This one includes all the new features and improvements from the previous preview update, but also fixes the installation issues that clobbered that update."
Meanwhile, as Windows 11 version 24H2 approaches its end of life this October, Microsoft is now force-updating users to the latest version, reports BleepingComputer:


"The machine learning-based intelligent rollout has expanded to all devices running Home and Pro editions of Windows 11, version 24H2 that are not managed by IT departments," Microsoft said in a Monday update to the Windows release health dashboard... "No action is required, and you can choose when to restart your device or postpone the update."


Neowin reports:

The good news is that the update from version 24H2 to 25H2 is a minor enablement package, as the two operating systems share the same codebase. As such, the update won't take long, and you should not encounter any disruptions, compatibility issues, or previously unseen bugs... Microsoft recently promised to implement big changes in how Windows Update works, including the ability to postpone updates for as long as you want. However, Microsoft has yet to clarify if that includes staying on a release beyond its support period.

Thanks to long-time Slashdot reader Ol Olsoc for sharing the news.

Read more of this story at Slashdot.

A former U.S. spy spoke to The New Yorker about "years of clandestine work for the C.I.A. — which, he said, had 'prevented Iran from getting a nuke'."

[Kevin] Chalker told me that, as he understood it, the Pentagon had suggested running commando operations to kill key Iranian scientists, as Israel subsequently did. But the C.I.A. proposed recruiting those scientists to defect, as U.S. spies had once courted Soviet physicists. Chalker paraphrased the agency's pitch: "We can debrief them and learn so much more — and, if they say no, then you can kill them." (A more senior agency official confirmed the broad strokes of his account.) The White House liked the agency's idea, and [president George W.] Bush authorized the C.I.A. to conduct clandestine operations to stop Iran from building a bomb. The C.I.A. program that Chalker described to me became publicly known in 2007, when the Los Angeles Times reported on the existence of an agency project called Brain Drain. But the details of the "invitations" to Iranian scientists have not previously been reported...

Chalker typically had about ten minutes to explain, as gently as possible, that he was from the C.I.A., that he had the power to secure the scientist and his family a comfortable new life in the U.S. — and that, if the offer was rejected, the scientist, regrettably, would be assassinated. (Chalker tried to emphasize the happier potential outcome.) Killing a civilian scientist would violate international law. The American government has denied ever doing it, and I found no evidence that the U.S. has carried out any such murders. A former senior agency official familiar with the Brain Drain project told me all that mattered was that Iranian scientists had believed they would be killed, regardless of whether the U.S. actually made good on the threat. And Israel had been conducting a campaign to assassinate Iranian scientists, which made the prospect of lethal reprisal highly plausible. Other former officials with knowledge of the project told me that the C.I.A. sometimes shared intelligence with Mossad which enabled its operatives to locate and kill a scientist. Such information exchanges were kept vague enough to preserve deniability if a more legalistic U.S. Administration later took office...

[Chalker] is confident that those who rebuffed him were, in fact, killed — one way or another... One of Chalker's colleagues told me that, against the backdrop of so many Israeli assassinations, Chalker's interactions with Iranian scientists could almost be considered humanitarian — he had been "throwing them a lifeline." Of the many scientists he approached, three-quarters ultimately agreed to coöperate.
Their 10,000-word article suggests Chalker may now be resentful the CIA didn't help him in a later unrelated lawsuit, noting it's "nearly unheard of for ex-spies to divulge their past activities."
But Chalker also says he "helped obtain pivotal information that laid the groundwork for more than a decade of American efforts to disrupt the Iranian nuclear-weapons program, from the Stuxnet cyberattacks, which occurred around 2010 [destroying 1,000 uranium-enriching centrifuges], to the Obama Administration's nuclear deal, in 2015, to the U.S. air strikes on Iranian atomic-energy facilities in the summer of 2025."

Read more of this story at Slashdot.

mikeleonardvisualarts posted a photo:

Thomas Hawk posted a photo:

Thomas Hawk posted a photo:

ajpscs posted a photo:

the SQUARE
HANAMI
© ajpscs

ajpscs posted a photo:

the SQUARE
HANAMI
© ajpscs

mikeleonardvisualarts has added a photo to the pool:

ajpscs has added a photo to the pool:

the SQUARE
HANAMI
© ajpscs

tintinetmilou has added a photo to the pool:

Kawagoe

TEHERAN (ANP) - In het gebied in Iran waar het vermiste bemanningslid van de neergehaalde F-15 zich vermoedelijk bevindt, worden volgens het Iraanse persbureau Tasnim luchtaanvallen uitgevoerd. Een lokale gouverneur stelt dat er drie mensen zijn omgekomen bij aanvallen door de Verenigde Staten en Israël, aldus Tasnim, dat banden heeft met de Iraanse Revolutionaire Garde.

Amerikaanse media meldden eerder op basis van bronnen binnen het Pentagon dat de VS met grote inspanning naar het vermiste bemanningslid zoekt. Het andere bemanningslid van het gevechtsvliegtuig is volgens Amerikaanse media gered. Iran weerspreekt dat.

Iraanse media berichtten eerder dat er mogelijk grote sommen geld zijn uitgeloofd voor de gevangenneming van het bemanningslid. Tasnim citeert in zijn berichtgeving een anonieme militaire bron die stelt dat de VS vermoedelijk de hoop op het redden van het bemanningslid hebben opgegeven en in plaats daarvan locaties bombarderen waar hij zich mogelijk bevindt, in een poging hem te doden.

NIJKERK (ANP) - De pro-Iraanse groep Harakat Ashab al-Yamin al-Islamiya (HAYI) heeft een video online gezet over de explosie in Nijkerk. Dat meldt de SITE Intelligence Group, een Amerikaanse groep die wereldwijd extremistische groeperingen monitort. Onduidelijk is of de beweging de ontploffing daarmee opeist.

HAYI plaatste eerder beelden van de explosies bij een joodse school in Amsterdam en een synagoge in Rotterdam, waarmee de organisatie verantwoordelijkheid leek te claimen. Datzelfde deed HAYI rond incidenten in België en Groot-Brittannië.

In tegenstelling tot eerdere filmpjes toont de nieuwe video niet de explosie in Nijkerk zelf. HAYI deelde wel foto's van het gebouw van Christenen voor Israël, waar vrijdagavond laat een ontploffing plaatsvond. Ook deelde HAYI een dreigement gericht aan aanhangers van Israël, aldus SITE.

In een reactie op vragen van persbureau AFP heeft de Nederlandse politie laten weten de video van HAYI nog niet te hebben gezien.

TEL AVIV (ANP) - Het industriecomplex dat de Israëlische luchtmacht zaterdag aanviel in het zuidwesten van Iran, werd gebruikt voor de productie van chemicaliën voor de wapenindustrie. Dat stelt het Israëlische leger.

Iran maakte eerder al melding van de aanval in de Speciale Petrochemische Zone van Mahshahr, waarbij vijf personen omkwamen. Volgens een woordvoerder van het ministerie van Olie wordt de getroffen infrastructuur niet alleen gebruikt om elektriciteit te leveren aan de petrochemische fabrieken in Mahshahr, maar speelt deze ook een belangrijke rol in de elektriciteitsvoorziening van 500.000 mensen in de provincie Khuzestan in de zomermaanden.

Iran reageerde in de nacht van zaterdag op zondag met een raketaanval op Israël. Een raket trof een onbewoond gebied in het zuiden van het land, aldus het leger. Er zijn geen gewonden gemeld.

Dichter Lieke Marsman schreef De dichter en de duivel, dat later dit jaar verschijnt. In het boek, geïnspireerd op Dantes Hel, daalt ze af in de onderwereld, een wereld die…

I see we are at the "US Navy base in Virginia asking for donations of toiletries" stage of the victory lap.

Sailors have been arriving in Norfolk, Va., home to the world's biggest naval base, since at least the middle of March. Several groups that provide aid to military personnel say that the sailors arrived with very little. A call went out to community groups, asking for basic supplies like hygiene products.

"The base was asking for donations of toiletries and different things for the sailors coming back, because they were coming back with nothing," said Derrick Johnson, commander of American Legion Post 327 in Norfolk.

The post hosted a spaghetti dinner for some of the sailors, said Keith Shanesy, one of the post's vice commanders.

Previously, previously, previously.

iain.davidson100 has added a photo to the pool:

iain.davidson100 has added a photo to the pool:

iain.davidson100 has added a photo to the pool: