X-Industry

Recently, cybersecurity researchers have found that entry points could be abused across multiple programming ecosystems like PyPI, npm, Ruby Gems, NuGet, Dart Pub, and Rust Crates to stage software supply chain attacks.  "Attackers can leverage these entry points to execute malicious code when specific commands are run, posing a widespread risk in the open-source landscape," Checkmarx researchers Yehuda Gelb and Elad Rapaport said in a report.[1]

The software supply chain security company noted

There have been some developments in the Ducktail phishing campaign.  To begin our report, it seems reasonable to go over a little bit of history on Ducktail for those who might be unfamiliar.  The Ducktail phishing campaign was first discovered and reported on in late July of 2022.  Researchers at the firm WithSecure are credited with the discovery of the campaign.  In terms of who is responsible, WithSecure’s report on this campaign indicated a high level of confidence in their belief that the