Hackers have stopped breaking in. They’re abusing the things developers already trust.
Hackers are not really breaking in any more. They are walking through doors we hold open for them.
This past week made the shift plain. Two campaigns showed that the things developers trust most, open-source code and AI tools, have become the easiest way to attack them.
1,000 poisoned packages
The first is a group called TeamPCP. In under four months, it has injected malicious code into more than 1,000 open-source software packages, according to CyberScoop. It started with a single tool in February and has barely slowed since.
The method is not clever, and that is the point. Most companies pull in code automatically and rarely check that it is safe. TeamPCP simply abuses that blind faith. Together, the poisoned packages rack up roughly 500 million downloads a week.
The named victims are a who’s-who: Bitwarden, Red Hat, SAP, PyTorch Lightning, even GitHub itself. Yet the group does not...
Copyright of this story solely belongs to thenextweb.com. To see the full text click HERE
