SSH keys stolen by stream of malicious PyPI and npm packages

A stream of malicious npm and PyPi packages have been found stealing a wide range of sensitive data from software developers on the platforms. The campaign started on September 12, 2023, and was first discovered by Sonatype, whose analysts unearthed 14 malicious packages on npm. Phylum reports that after a brief operational hiatus on September 16 and 17, the attack has resumed and expanded to the

[door-s-dev]

こうゆうのChatGPTで検出できないかな

[Shinwiki]

今回は勝利

[fn7]

docker内で使うのが無難か。

[efcl]

SSHのキーを狙うマルウェア

[ya--mada]

gitレポジトリにアクセスする秘密鍵が欲しいのか？でも開発環境に直接 ./ssh/priv.key 置くかな？ssh -A で入るのでは？知らんけど