Hacker News with Generative AI: Malicious Software

Offical XRP NPM package has been compromised and key stealing malware introduced (aikido.dev)
At 21 Apr, 20:53 GMT+0, our system, Aikido Intel started to alert us to five new package version of the xrpl package. It is the official SDK for the XRP Ledger, with more than 140.000 weekly downloads. We quickly confirmed the official XPRL (Ripple) NPM package was compromised by sophisticated attackers who put in a backdoor to steal cryptocurrency private keys and gain access to cryptocurrency wallets.
Security, Cryptography, Cryptocurrency, Software, Malicious Software
55 points by flxga 4 days ago | 17 comments
Malicious extensions circumvent Google's remote code ban (palant.info)
As noted last week I consider it highly problematic that Google for a long time allowed extensions to run code they downloaded from some web server, an approach that Mozilla prohibited long before Google even introduced extensions to their browser. For years this has been an easy way for malicious extensions to hide their functionality. When Google finally changed their mind, it wasn’t in form of a policy but rather a technical change introduced with Manifest V3.
Security, Web Browsers, Google Chrome, Extensions, Malicious Software
30 points by campuscodi 96 days ago | 6 comments