Toptal’s GitHub Hijack: Malicious NPM Packages Steal Tokens and Wipe Systems
Hackers breached Toptal’s GitHub account to unleash ten malware-laden packages on NPM, including Picasso. These packages, designed to steal data and wipe systems, were downloaded 5,000 times before detection. While Toptal swiftly deprecated the malicious packages, they have yet to issue a public statement.
Hot Take:
Oops, they did it again! Hackers strike Toptal’s GitHub, proving that even top talent needs a little extra security TLC. Who knew malicious packages were the latest trend in developer nightmares?
Key Points:
- Hackers gained access to Toptal’s GitHub, publishing 10 malicious packages on NPM.
- The packages contained code to steal GitHub authentication tokens and wipe systems.
- Over 5,000 downloads of the malicious packages occurred before detection.
- Attackers used ‘preinstall’ and ‘postinstall’ scripts to execute their dastardly plan.
- Toptal deprecated the malicious packages but has yet to make a public statement.
Already a member? Log in here