SlowMist tiết lộ cuộc tấn công chuỗi cung ứng qua ghi chép chéo nhắm vào các nhà phát triển tiền điện tử và AI

The chain analyst PeckShield (@PeckShieldAlert) monitored that SlowMist’s threat intelligence system, MistEye, detected a cross-registry supply chain attack targeting developers. Malicious packages have spread across the three major registries: npm, PyPI, and Crates.io, involving over 34 malicious packages and more than 384 related versions. The attack targets developers in the cryptocurrency, DeFi, Solana, Sui/Move, and AI communities, potentially leading to theft of crypto wallets, SSH keys, cloud credentials, GitHub/AWS tokens, browser data, and other developer secrets. Some malicious payloads also attempt to achieve persistent persistence via .cursorrules, CLAUDE.md, Git hooks, cron, systemd, and SSH. SlowMist recommends immediately removing affected packages, isolating compromised systems, rotating exposed credentials, and rebuilding CI environments and developer machines from clean images, while conducting a comprehensive review of activities related to GitHub, cloud services, SSH, and wallets.