Author: HackWatchit

Ten npm packages were suddenly updated with malicious code yesterday to steal environment variables and other sensitive data from developers’ systems. The campaign targeted multiple cryptocurrency-related packages, and the popular ‘country-currency-map’ package was downloaded thousands of times a week. The malicious code was discovered by Sonatype researcher Ali ElShakankiry and is found in two heavily obfuscated scripts, “/scripts/launch.js” and “/scripts/diagnostic-report.js,” which execute upon the package installation. Malicious diagnostic-report.js scriptSource: BleepingComputer Sonatype says that the JavaScript steals the device’s environment variables and sends them to the remote host “eoi2ectd5a5tn1h.m.pipedream(.)net)”. Environment variables are commonly targeted as they can contain API keys, database credentials, cloud credentials,…

What happens when market volatility spikes and early-stage tokens scramble for attention? Picture a crowded room where only the loudest voices get heard—smaller projects, no matter their potential, often fade into the background. WOO X Research, the analytical wing of centralized crypto trading platform WOO X, flagged a growing issue: a liquidity squeeze is gripping early-stage tokens. With US fiscal shifts and global uncertainties stirring the pot, underfunded projects find themselves outmatched by their better-funded peers.The crypto market has never been a level playing field. Volatility, a constant companion, has intensified lately, pushing smaller tokens to the sidelines. WOO X…

Despite advances in security technology, cybersecurity attacks and data breaches are increasingly common as attackers keep discovering new vulnerabilities and infiltration methods. Organizations now understand that a cyberattack or data breach is often inevitable—it’s typically a question of when, not if. The positive side is that cybersecurity crisis management plans can help businesses prepare effectively for these incidents. To grasp the meaning of crisis management in cybersecurity, it’s essential first to review concepts like crisis, crisis management, and cyberattacks. In this blog, we will discuss about cyber crisis management plan in detail.  What is a Cyber Crisis Management Plan? The…

The rise of mobile banking has changed how businesses and customers interact. It brought about increased convenience and efficiency, but has also opened new doors for cybercriminals, particularly on the Android platform, which dominates the global smartphone market. According to ESET research, Android financial threats, targeting banking apps and cryptocurrency wallets, grew by 20% in H2 of 2024 compared to the first half of the year. Fortunately, large financial institutions like banks have significant resources, enabling them to invest in and implement comprehensive cybersecurity measures to protect their systems and customers. However, smaller banks, wealth management firms or insurance agencies…

New research by Forescout Research’s Vedere Labs exposed vulnerabilities in solar power systems after analyzing six major solar inverter manufacturers, including Huawei, Sungrow, Ginlong Solis, Growatt, GoodWe, and SMA Solar Technology. The SUN:DOWN research revealed that Sungrow, SMA, and Growatt have nearly 50 vulnerabilities that could disrupt the power grid and lead to blackouts. Additionally, the research identified 93 known vulnerabilities, with 80 percent classified as high or critical severity, having a CVSS score ranging from 9.8 to 10. These vulnerabilities pose significant risks, potentially enabling dangerous attacks on power grids and smart-home devices. Forescout said that it “did not…

Slides At Black Hills Information Security (BHIS), we make our living doing pentesting, but we’ve never once been paid for a pentest. Penetration Testers get paid for their reports. For their explanations. For their story of the environment as it appears to an attacker. The scanning and testing and exploiting (and failing at those things) is nothing more than input for the report. So if the job of pentesting is all about creating a good report, why is it so common to hear how much testers hate reporting? Is there any way to make it all less difficult, or more…

A YouTuber has unleashed an innovative AI bot army to disrupt and outwit the world of online scammers, and a New York Times investigation looks into the intricate web of global money laundering. All this and more is discussed in the latest edition of the award-winning “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault. Warning: This podcast may contain nuts, adult themes, and rude language. Hosts: Graham Cluley:  @grahamcluley.com  @[email protected] Carole Theriault:  @caroletheriault Episode links: Sponsored by: Vanta – Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing…

OpenAI is prioritizing security with a major bug bounty program increase and new AI security research grants. Find out how they’re collaborating with researchers and experts to protect their AI platforms from emerging threats OpenAI is enhancing its security infrastructure, focusing on a forward-looking approach towards AI, by expanding security initiatives across grant programs, bug bounties, and internal defences. In its latest blog post, OpenAI has unveiled a suite of new cybersecurity initiatives, signalling a bold push towards artificial general intelligence (AGI). A key element of this strategic move is a substantial increase in the maximum reward offered through its…

Introduction Writing code is about solving problems, but not every problem is predictable. In the real world, your software will encounter unexpected situations: missing files, invalid user inputs, network timeouts, or even hardware failures. This is why handling errors isn’t just a nice-to-have; it’s a critical part of building robust and reliable applications for production. Imagine an e-commerce website. A customer places an order, but during the checkout process, a database connection issue occurs. Without proper Error Handling, this issue could cause the application to crash, leaving the customer frustrated and the transaction incomplete. Worse, it might create inconsistent data,…