Jossef Harush Kadouri – Medium

Jossef Harush Kadouri

Jossef Harush Kadouri
in
Checkmarx Zero

Backdoor Discovered in xz: The Most Advanced Supply Chain Attack Known to Date

The xz project, a tool used by many Linux distributions for compressing files, was compromised by a malicious actor who gradually took over…

Mar 31

Backdoor Discovered in xz: The Most Advanced Supply Chain Attack Known to Date

Mar 31

Jossef Harush Kadouri
in
Checkmarx Zero

When ‘Everything’ Goes Wrong: NPM Dependency-Hell Campaign — 2024 Edition

Happy New Year! What a way to open 2024 with a package named “everything” that relies on every single NPM package causing disruptions

Jan 2

When ‘Everything’ Goes Wrong: NPM Dependency-Hell Campaign — 2024 Edition

Jan 2

Jossef Harush Kadouri
in
Checkmarx Zero

Surprise: When Dependabot Contributes Malicious Code

In July 2023, we detected suspicious commits in hundreds of GitHub repositories, appearing as if contributed by Dependabot but carrying…

Sep 27, 2023

Surprise: When Dependabot Contributes Malicious Code

Sep 27, 2023

Jossef Harush Kadouri
in
Checkmarx Zero

Popular NuGet Package “Moq” Silently Exfiltrates User Data to Cloud Service

The highly popular NuGet package Moq with total downloads of 475M+, released on August 8th new versions 4.20.0-rc, 4.20.0 and 4.20.1with a…

Aug 9, 2023

Popular NuGet Package “Moq” Silently Exfiltrates User Data to Cloud Service

Aug 9, 2023

Jossef Harush Kadouri
in
Checkmarx Zero

Who Broke NPM?: Malicious Packages Flood Leading to Denial of Service

Malicious campaigns targeting open-source ecosystems are causing a flood of spam, SEO poisoning, and malware infection.

Apr 4, 2023

Who Broke NPM?: Malicious Packages Flood Leading to Denial of Service

Apr 4, 2023

Jossef Harush Kadouri
in
Checkmarx Zero

Massive Malicious Attack on NPM: 50k Packages Flooded with Phishing Links

A sudden surge of thousands of malicious packages was uploaded to the NPM open-source ecosystem from multiple user accounts the last…

Mar 26, 2023

Massive Malicious Attack on NPM: 50k Packages Flooded with Phishing Links

Mar 26, 2023

Jossef Harush Kadouri
in
Checkmarx Zero

This is How I Hijacked CocoaPods Subdomain Using GitHub Pages

CocoaPods is THE dependency manager for iOS and Mac projects. It helps software developers easily add pre-made pieces of code (called…

Mar 2, 2023

This is How I Hijacked CocoaPods Subdomain Using GitHub Pages

Mar 2, 2023

Jossef Harush Kadouri
in
Checkmarx Zero

900+ Malicious Python Packages Manipulating Victim’s Clipboard to Steal Crypto

Starting Feb 9 2023, an attacker published a total of 444 malicious packages via 22 different PyPi user accounts. The malicious packages…

Feb 10, 2023

900+ Malicious Python Packages Manipulating Victim’s Clipboard to Steal Crypto

Feb 10, 2023

Jossef Harush Kadouri
in
Checkmarx Zero

Chat With a Software Supply Chain attacker

A PyPi user account, aidoc, was found to have been publishing malicious packages

Jan 22, 2023

Chat With a Software Supply Chain attacker

Jan 22, 2023

Jossef Harush Kadouri
in
Checkmarx Zero

Mixing Politics and Open Source: Bad Idea

During the past year, since the Russia-Ukraine war began, we’ve seen multiple examples of open-source packages with hidden protest messages…

Jan 12, 2023

Mixing Politics and Open Source: Bad Idea

Jan 12, 2023

Jossef Harush Kadouri

Jossef Harush Kadouri

Founder of dusti.co and zeronetworks.com. Writing about: Attackers, Software Supply Chain Security, and Malware Analysis

Following

Help
Status
About
Careers
Press
Blog
Privacy
Terms
Text to speech
Teams