TGViewer
Programming Programming @programmingreddit · 904 subscribers
Post #13249 95
a fake bug fix PR hid a credential stealer in astro.config.mjs that used blockchain to receive commands
https://safedep.io/astro-config-blockchain-c2-supply-chain/

https://redd.it/1u3u9h5
@programmingreddit
SafeDep - Real-time Open Source Software Supply Chain Security astro.config.mjs Supply Chain Attack via Blockchain C2 An obfuscated IIFE hidden in astro.config.mjs fires at every build, beacons an HTTP C2, and pulls staged commands from a Tron-to-BSC blockchain dead drop.
Open in Telegram All posts from @programmingreddit
More from @programmingreddit
  1. Sep 28, 2026Packing Binary Is Fun, Actually https://hereticpleb.vercel.app/blog/packing-binary-is-fun-…
  2. Sep 27, 2026Don't couple your Go code to GitHub https://iain.rocks/blog/dont-couple-your-go-code-to-gi…
  3. Sep 27, 2026Postgres AT TIME ZONE 'UTC' does NOT do what you think it does https://bookofrevenue.com/b…
  4. Sep 26, 2026Optimizing a Lock-Free Ring Buffer https://david.alvarezrosa.com/posts/optimizing-a-lock-f…
  5. Sep 25, 2026Microservices are organizational debt disguised as architecture. https://martinfowler.com/…
  6. Sep 25, 2026We still maintain a development tool first released in 1993. Here’s what 30+ years of back…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →