fromArs Technica
1 week agoSelf-propagating malware poisons open source software and wipes Iran-based machines
CanisterWorm, as Aikido has named the malware, targets organizations' CI/CD pipelines used for rapid development and deployment of software. Every developer or CI pipeline that installs this package and has an npm token accessible becomes an unwitting propagation vector.
Information security