Новый червь ChainDrop поразил более 400 NPM-пакетов

Зафиксирована массовая атака на пакеты в репозитории NPM, проводимая с использованием нового самораспространяющегося червя ChainDrop, подставляющего вредоносное ПО в зависимости. В результате атаки опубликовано 2212 вредоносных выпусков для 444 пакетов. Наиболее популярные из скомпрометированных пакетов keyv, flat-cache и file-entry-cache насчитывают 154, 149.9 и 147.6 миллионов загрузок в неделю.
Загрузчик червя размещался в файлах setup.mjs и Math_Symbol.js, которые запускались при помощи preinstall-обработчика ("preinstall": "node setup.mjs"), вызываемого при установке поражённого пакета. Указанные скрипты загружали легитимный Bun runtime и обфусцированный код червя, размером 710 Кб. После активации червь выполнял поиск в системе и в переменных окружения токенов к NPM, PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp, KubernetesK8s и другим сервисам (всего анализировалось более 140 файловых путей, типа ~/.npmrc), а также анализировал память (через /proc/<pid>/mem) окружения GitHub Actions на предмет токенов и учётных данных.
В случае обнаружения токена для подключения к каталогу NPM червь автоматически публиковал новые вредоносные релизы для разрабатываемых в текущем окружении пакетов, поражая дерево зависимостей. В отличие от ранее выявленного червя Shai-Hulud 2.0 в ChainDrop была реализована техника EtherHiding для получения управляющих команд через публичный блокчейн Ethereum, задействовано шифрование для скрытия передаваемых на сервер атакующих конфиденциальных данных и обеспечено внедрение в файлы конфигурации Claude Code, VS Code и GitHub Copilot для закрепления присутствия в системе.
Атака началась с компрометации процесса формирования релизов на базе GitHub Actions для пакета keyv, насчитывающего 154 млн загрузок в неделю и используемого как зависимость в 1703 пакетах. Атакующие сформировали новую версию 6.0.0, подставив в неё вредоносный код, и опубликовали её с использованием механизма «Trusted Publishers» и корректной SLSA-аттестацией. После публикации червь поразил многие зависимые от keyv пакеты и по цепочке стал поражать непрямые зависимости.
Среди наиболее популярных пакетов, которые оказались поражены червём, опубликовавшим для них вредоносные релизы:

flat-cache 6.1.24 (149.8 млн загрузок в неделю);
file-entry-cache 11.1.6 (147.5 млн);
cacheable-request 13.0.20 (33.9 млн);
@cacheable/utils 2.5.1 (8.7 млн);
cacheable 2.5.1 (7.8 млн);
@cacheable/memory 2.2.1 (7.1 млн);
cache-manager 7.2.10 (4.2 млн);
@cacheable/node-cache 3.1.2 (1.5 млн).




 javascript, npm, opennet, атака, безопасность

👉@sysadminoff

https://www.linux.org.ru/news/security/18352803

В ходе тестирования AI-агент попытался скомпрометировать проект на GitHub

Организация AISI (AI Security Institute), учреждённая при департаменте науки, инноваций и технологий Великобритании, опубликовала отчёт об эксперименте, приведшем к результатам, напоминающем случай с AI-агентом OpenAI. При 122 тестовых запусках для решения поставленной задачи AI-агенты совершили 19 несанкционированных действий в сети интернет (в 17 случаях использовалась модель Mythos 5, в 2 - GPT-5.6 Sol, у которых не ограничен доступ в интернет и были отключены механизмы, ограничивающие использование для проведения кибератак).

👉@sysadminoff

https://www.opennet.ru/opennews/art.shtml?num=66031

ELinks 0.20.0

Состоялся выпуск 0.20.0 ELinks – программы для просмотра в текстовом режиме веб-страниц (в том числе капсулы gemini и страницы gopher). С самого начала целью проекта было создание многофункционального текстового браузера с открытой политикой включения патчей и функций, и активной разработкой. Одной из таких функций является включение в ELinks Links-Lua, который добавляет в ELinks возможность использования пользовательских скриптов.
( читать дальше... )



 elinks, tui, web, браузер, консоль

👉@sysadminoff

https://www.linux.org.ru/news/opensource/18352909

How to Use the watch Command in Linux to Monitor Commands in Real Time

The post How to Use the watch Command in Linux to Monitor Commands in Real Time first appeared on Tecmint: Linux Howtos, Tutorials & Guides .You’ve probably run df -h, waited a few seconds, and run it again while a file copy or backup was
The post How to Use the watch Command in Linux to Monitor Commands in Real Time first appeared on Tecmint: Linux Howtos, Tutorials & Guides.

👉@sysadminoff

https://www.tecmint.com/watch-command-in-linux/

📰 Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent

Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent.The researchers said the public agent could be prompt-injected into posting /adk-issue-fix as adk-bot. They identified the bot as a collaborator, so that comment satisfied.

🔗 Source: https://thehackernews.com/2026/08/google-deletes-3-adk-ai-workflows-after.html

#python

👉@sysadminoff

📰 Linux Foundation Announces Tokenomics Foundation For "Economics & ROI Of AI Value"

Last month the Linux Foundation launched the x402 Foundation to standardize Internet-native payments for AI agents as their latest AI play. That followed other "AI" initiatives from dealing with AI exploits to AI asset and data exchange. Today they have another AI foray being announced with the creation of the Tokenomics Foundation...

🔗 Source:

#linux

👉@sysadminoff

https://www.phoronix.com/news/Linux-Foundation-Tokenomics

[fwm] my own physics-based window manager.
By ilu-ilu on Reddit (Unixporn)

👉@sysadminoff

https://www.reddit.com/r/unixporn/s/dAkXvG73lF

📰 AMD openSIL & Coreboot Pull Requests For Phoenix AM5 Support

Last week the 3mdeb firmware consulting firm released the first open-source firmware for a modern AMD Ryzen AM5 platform with their work to port AMD openSIL and Coreboot in their downstream Dasharo flavor to an MSI desktop ATX motherboard. Now that it's working out well, 3mdeb is working to upstream their AM5 platform support and Phoenix SoC support into upstream AMD openSIL as well as Coreboot...

🔗 Source:

#amd #opensource

👉@sysadminoff

https://www.phoronix.com/news/AMD-openSIL-Phoenix-AM5-PR

📰 I replaced Chrome, Firefox, and Brave with a minimalist browser that forces me to touch grass

It's pretty normal for most of us to have multiple browsers open across the day. For me, Chrome is where my work lives, Brave is where my studying lives, and Firefox is for everything else. I don't think any of them are particularly bad, but they do kind of keep adding stuff you didn't ask for: a Gemini nudge here, a Copilot sidebar there, a new page trying to get me to pay for something, etc.

🔗 Source:

#firefox

👉@sysadminoff

https://www.xda-developers.com/replaced-chrome-firefox-brave-with-minimalist-browser-opera-air/

Open Secure AI Alliance opens SAFE rules for sharing AI incidents

The Open Secure AI Alliance is a coalition led by NVIDIA and supported by prominent members including Microsoft, IBM, Cisco, CrowdStrike, Hugging Face, Palantir, Dell Technologies, Red Hat, and the Linux Foundation. Formed in late July 2026 to develop and share open tools for securing AI models, agents, and software infrastructure, the alliance has grown to more than 120 organizations and has opened a Request for Comments on SAFE, a proposed system for confidentially sharing security incidents and near misses involving AI agents.
Source

👉@sysadminoff

https://4sysops.com/archives/open-secure-ai-alliance-opens-safe-rules-for-sharing-ai-incidents/

Microsoft: MSIX Remove is not uninstall

MSIX “Remove” does not guarantee that an application’s binaries are deleted from disk. The operation deregisters the app for a user, while Windows only removes the package payload when no users, processes, or other references still depend on it.
Source

👉@sysadminoff

https://4sysops.com/archives/microsoft-msix-remove-is-not-uninstall/

📰 Paprius icon set gets first update in a over year with 80+ new icons

Fan of the the Papirus icon theme will be pleased to hear there a new update – the first since May 2025. For Papirus’s first update in 2026 (the tardiness of which its maintainer, Serhii Yeremenko, apologises) brings over 80 new icons or updated icons spanning apps, games and user-interface icons, plus new file mimetypes and revised symlinks. Frequent updates are why Papirus icons are popular with Linux users, and have been for such a long time.

🔗 Source:

#linux

👉@sysadminoff

https://www.omgubuntu.co.uk/2026/08/paprius-icon-pack-sees-first-update-in-a-year-with-80-new-icons

📰 77 Open VSX extensions found harvesting developer info
77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environments where they were installed

🔗 Source: https://www.bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-developer-info/

👉@sysadminoff

https://www.bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-developer-info/amp

📰 Bottles 65 Released with Over 100 Changes for Windows Apps on Linux

Bottles 65 improves Windows app and game management on Linux with Steam integration, backups, file associations, and numerous fixes.

🔗 Source:

#linux #steam

👉@sysadminoff

https://linuxiac.com/bottles-65-released-with-over-100-changes-for-windows-apps-on-linux/

📰 My phone can't replace a Raspberry Pi for this home server project

Even though it can run plenty of self-hosted services.

🔗 Source:

#raspberry

👉@sysadminoff

https://www.xda-developers.com/my-phone-cant-replace-a-raspberry-pi-for-this-home-server-project/

📰 NVIDIA Joins Dell and HP in Supporting the Linux Vendor Firmware Service (LVFS)

Linux Vendor Firmware Service creator Richard Hughes announced that NVIDIA has also agreed to become a premier sponsor for the LVFS.

🔗 Source: https://9to5linux.com/nvidia-joins-dell-and-hp-in-supporting-the-linux-vendor-firmware-service-lvfs

#linux

👉@sysadminoff

Chrome’s on-device AI now needs 20 GB of free disk space

Google has quietly expanded Chrome’s on-device AI documentation with concrete download requirements, including approximately 20 GB of free storage. Chrome may download its roughly 4 GB Gemini Nano model only on supported hardware with enough processing capacity and an unmetered internet connection.
Source

👉@sysadminoff

https://4sysops.com/archives/chromes-on-device-ai-now-needs-20-gb-of-free-disk-space/

📰 This gorgeous KDE icon pack gives your desktop a chalk-like look

One of the biggest things I love about Linux is that it's very customizable. There's no need to install third-party apps and use workarounds to get the look and feel you want; most of the time, the OS itself comes with all the support you'd need to do what you want. Such is the case with this delightful icon pack you can download and install onto KDE right now.

🔗 Source:

#kde #linux

👉@sysadminoff

https://www.xda-developers.com/this-gorgeous-kde-icon-pack-gives-your-desktop-a-chalk-like-look/

Cloudflare opens WriteGuard beta to stop runaway MCP agent writes

Cloudflare is bringing WriteGuard to a private beta for MCP server portals, giving organizations centralized controls over AI agents that can change tickets, code, documents, or production systems. The layer can block risky tool calls before execution, identify the agent session behind a user’s credentials, and make machine-generated activity searchable.
Source

👉@sysadminoff

https://4sysops.com/archives/cloudflare-opens-writeguard-beta-to-stop-runaway-mcp-agent-writes/

📰 Mozilla Firefox 153.0.3 Improves the Smart Window and Fixes More Bugs

Firefox 153.0.3 open-source web browser is now available for download to fix more issues discovered in the latest Firefox 153 release and also add some improvements.

🔗 Source: https://9to5linux.com/mozilla-firefox-153-0-3-improves-the-smart-window-and-fixes-more-bugs

#firefox #opensource

👉@sysadminoff