supply chain security
2 posts
Article
Fake font steals developer credentials
GhostAction's second stage hides a credential stealer in a fake font file that runs when developers open the project in VS Code.
Article
A trusting-trust backdoor built from GNU strip
A tampered copy of GNU strip in the NixOS binary seed carried a trusting-trust backdoor into almost every binary of a complete graphical installer.