> If you use npm, go get or other automatic dependency grabbing systems you better be pinning deps to particular hashes.
> 
> Do not blindly trust deps by name.
> 
> Do not allow deps to automatically upgrade to a newer version.
> 
> Hard part: Your deps might be blindly trusting their deps.
> 
> https://twitter.com/stephenlacy/status/1554697077430505473

https://twitter.com/wtogami/status/1554716537323302912
https://nitter.it/wtogami/status/1554716537323302912

> I have yet to find a single real GH org; it's all copies with 0 stars, created in the last 6-10 days.
>
> Still something [@github](https://twitter.com/github) needs to cleanse, but far, far more limited than the quoted tweet makes it sound.

https://twitter.com/TwitchiH/status/1554718007443832832

> As this is making the rounds, some more context:
> 
> This appears to be an extremely broad, low value, low effort, and likely low impact attack.
> 
> Given two major *coin attacks in the last 24 hours or so, infosec news gets more attention than usual.

https://twitter.com/TwitchiH/status/1554725705438601216
https://nitter.net/TwitchiH/status/1554725705438601216

cryptocoin

Hard to conclude that this is directly related to the solana private key leaks. Nevertheless, you should rotate your application secrets if you used any of the fake libraries on GitHub.

Always use rotating secrets if you can and vet the libraries you use.

https://twitter.com/stephenlacy/status/1554697077430505473

https://twitter.com/lxjhk/status/1554727870244605952

https://nitter.it/lxjhk/status/1554727870244605952

bitcoin

🧵 Widespread malware attack on GitHub

> Hard to conclude that this is directly related to the solana private key leaks. Nevertheless, you should rotate your application secrets if you used any of the fake libraries on GitHub.
> 
> Always use rotating secrets if you can and vet the libraries you use.
>
> https://twitter.com/stephenlacy/status/1554697077430505473

https://twitter.com/lxjhk/status/1554727870244605952
https://nitter.it/lxjhk/status/1554727870244605952