Multifaceted, high-precision campaign targets malicious and benevolent hackers alike.

Dan Goodin

Yearlong supply-chain attack targeting security pros steals 390K credentials

Multifaceted, high-precision campaign targets malicious and benevolent hackers alike.

Ars Technica (arstechnica.com)

Matt Blaze

@dangoodin So, I guess the "I'm safe because I compile everything from source" thing isn't all it's cracked up to be.

pasta la vida

@mattblaze @dangoodin

I'm beginning to think that npm (or other dev tools) shouldn't have access to dotfiles, but should be chrooted into the particular git repo they're in.