TrapDoor supply chain attack hits PyPI, NPM, and crates.io
A supply chain attack known as TrapDoor has affected popular package repositories including PyPI, NPM, and crates.io. The attack compromised Laravel Lang packages, introducing a remote code execution (RCE) backdoor across over 700 versions. This incident has raised concerns about the security of cloud, CI/CD, and developer secrets.
- ▪The TrapDoor attack targeted multiple package repositories.
- ▪Laravel Lang packages were found to contain an RCE backdoor.
- ▪The backdoor affected more than 700 versions of the packages.
Opening excerpt (first ~120 words) tap to expand
.css-14sa009{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-flex-direction:column;-ms-flex-direction:column;flex-direction:column;height:var(--chakra-sizes-full);}.css-mb1474{position:relative;aspect-ratio:16/9;background:var(--chakra-colors-gray-950);--bg-currentcolor:var(--chakra-colors-gray-950);margin-bottom:var(--chakra-spacing-2);overflow:hidden;width:var(--chakra-sizes-full);}.css-c05207{object-fit:cover;object-position:center;position:absolute;inset:0;width:var(--chakra-sizes-full);height:var(--chakra-sizes-full);}.css-x8iw57{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-flex-direction:column;-ms-flex-direction:column;flex-direction:column;-webkit-flex:1;-ms-flex:1;flex:1;padding-inline:var(--chakra-spacing-4);p…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Socket.
Discussion
0 commentsMore from Socket
