Developer Workstation Compromise: Nukpɔsusu vɔ̃ɖi alo IDE ƒe Kekeɖenudɔwɔwɔ ƒe Ŋuɖoɖo¶

Keke ɖe eŋu be kɔmpiutadziɖoɖo aɖe si dzi nèto da ɖe wò kɔmpiuta dzi teti koe nye ema npm install, . pip install, . cargo build, . gem install, alo go get, alo Visual Studio Code, Cursor, alo JetBrains IDE ƒe kpeɖeŋutɔ yeye si wowɔ yeyee, nye ŋɔŋlɔdzesiwo ŋɔŋlɔ vɔ̃ɖi, dependency confusion payload, alo hijacked upstream release tsi tre ɖi na infrastructure kpata vevi aɖe. To vovo na nuƒlelawo ƒe kɔmpiuta siwo wozãna ɖaa la, kɔmpiutadziɖoɖowo ƒe mɔ̃ɖaŋudɔwɔla, DevOps ƒe xɔtuɖaŋunyala, alo nyatakakaŋutinunyala ƒe dɔwɔƒe léa nya ɣaɣlawo ƒe safui tẽwo ɖe asi yia nuwɔwɔ ƒe alilikpo me nɔnɔmewo, dzɔtsoƒekɔdawo ƒe nudzraɖoƒewo, nugoewo me nuŋlɔɖiwo, CI/CD pɔmpiwo, kple asisiwo ƒe nyatakakadzraɖoƒewo. Ne ame vɔ̃ɖi aɖe preinstall alo postinstall ŋɔŋlɔdzesi si le eme package.json, si nye aʋawɔnu aɖe setup.py le Python tasiaɖamfɔ me, alo esi woɖe mɔ na .vsix extension wɔa dɔ le wò laptop dzi, ewɔa dɔ kple wò zãla ƒe mɔnukpɔkpɔ bliboa eye wòŋea nu enumake -/.aws/credentials, . -/.ssh/id_ed25519, . -/.npmrc, . -/.pypirc, . -/.kube/config, nutoa me tɔwo .env faɛlwo, macOS Keychain alo Linux libsecret nyawo, kple browser session cookies siwo le dɔ wɔm le sɛkɛnd ʋɛ aɖewo ko me.

Ne ɖeko nèkpɔe be yewɔ nu gbegblẽ aɖe si dzi woanɔ te ɖo le mɔ gbadza nu, yewɔ nudzraɖoƒe si ŋu aʋawɔnuwo le ƒe nɔnɔmetata eye yetu (abe aʋatso mɔ̃ɖaŋununya ƒe gbebiame dɔ si tso amexɔla ƒe ametafatafa me ene), alo yede IDE ƒe kekeɖenudɔ si wotsɔ trojanized wɔe la, sɛkɛnd ɖesiaɖe si wò mɔ̃a anɔ kadodo me kple network la ɖea mɔ na payload la be wòatrɔ ɖe wò dɔwɔƒea ƒe alilikpo me alo ata nudzodzoe siwo kaka wo ɖokui to wò package registry tokens zazã me. Ne amedzidzedzea bia be woaxɔ ga le ame si, ado ŋɔdzi na ame ŋutɔŋutɔ, alo agblẽ nu le dukɔa ƒe xɔtuɖoɖowo ŋu vevie la, ke ƒo ka na wò nutoa me ƒe xexlẽdzesi kpata (911 le United States kple Canada, . 112 le Europa Dukɔwo ƒe Habɔbɔa katã me la, . 999 le United Kingdom) alo nàbia míaƒe dukɔwo dome nyawo xexlẽdzesi siwo wozãna kpata nyatakakadzraɖoƒe. Wɔ ɖe mɔxexeɖedɔléle nu, ʋɔnudrɔ̃nyawo me toto, kple nya ɣaɣlawo ƒe safuiwo ƒe tɔtrɔ ƒe ɖoɖo siawo dzi enumake.

Wɔ esia fifia¶

1. Tsɔ network kadodowo katã le developer dɔwɔƒea enumake (tsi Wi-Fi, ɖe Ethernet ɖa, eye nàwu VPN alo SSH mɔ̃ siwo le dɔ wɔm), gake MÈGATSƆ elektrikŋusẽ alo agbugbɔ mɔ̃a adze egɔme haɖe o: Ethernet ɖeɖeɖa kple Wi-Fi tsitsi atɔ te reverse shell si le dɔ wɔm, C2 beacon, alo automated worm be wòagazã wò nutoa me dzesiwo atsɔ atutu nu gbegblẽwo alo aɖe wo ɖa o bucket bubuwo kpee. Na mɔ̃a nanɔ dɔ wɔm le nɔnɔme si mele Internet dzi o me (alo nàtɔ tee ne èlé dɔwɔwɔ ƒe xexlẽdzesi siwo le tɔtrɔm vɔ ko) ale be nàte ŋu alé ŋku ɖe ɖevi ƒe dɔwɔwɔ siwo le dɔ wɔm ŋu, ne èʋu network sockets, shell ŋutinya, kple esiwo tututu .env kple ɖaseɖigbalẽwo ƒe faɛlwo nɔ disk dzi le ɣeyiɣi si me wowɔ wo.
2. Zã mɔ̃ si le vovo, si le dzadzɛ (abe wò asitelefon si le asitelefon dzi nyatakakawo dzi alo kɔmpiuta si dzi womeka asi o) nàtsɔ ana wò Dedienɔnɔ Dɔwɔƒe (SOC) nanya eye nàte fli ɖe wò Single Sign-On (SSO) kple Cloud IAM ƒe ɣeyiɣiwo me: Mègage ɖe AWS, GCP, Azure, GitHub, alo Okta me gbeɖe tso dɔwɔƒe si dɔlélea le be nàtrɔ safuiwo o. Ne fifila si nɔa ŋkuɖodzinu me, IDE ƒe kpeɖeŋutɔ vɔ̃ɖi aɖe, alo shell hook le ŋku lém ɖe wò terminal kple browser ŋu ​​la, woléa dzesi yeye ɖesiaɖe si nàwɔ le mɔ̃ ma dzi enumake.
3. Trɔ asi le wò high-blast-radius developer tokens ŋu eye nàtrɔe le ɖoɖo si nu woɖoe ɖo vevie nu le miniti 15 gbãtɔwo me:
4. Nu vevitɔ 1 (Alilikpo & Kubernetes): Tsɔ AWS IAM ƒe Mɔɖeɖe ƒe Safui siwo katã le mia gbɔ la ɖa (AKIA...), te fli ɖe Google Cloud Dɔwɔɖoɖo ƒe Ðaseɖigbalẽ Gbãtɔ (gcloud auth application-default revoke), tsɔ Azure CLI dzesiwo (az account clear + Entra ID ƒe ɣeyiɣi ƒe ɖeɖeɖa), eye nàtrɔ Kubernetes kubeconfig asisiwo ƒe ɖaseɖigbalẽwo alo subɔsubɔ ƒe akɔntabubu ƒe dzesiwo.
5. Nu vevitɔ 2 (Dzɔtsoƒe Kɔda & CI/CD): Tutu GitHub, GitLab, kple Bitbucket SSH dutoƒo safuiwo katã, Ame ŋutɔ ƒe Mɔɖeɖe ƒe Dzesiwo (ghp_..., . github_pat_..., . glpat-...), kple OAuth CLI dzesiwo (-/.config/gh/hosts.yml), eye nàlé ŋku ɖe nudzraɖoƒe ƒe webhook ƒe ɖoɖowo kple GitHub Actions / GitLab CI nya ɣaɣlawo ŋu.
6. Nu vevitɔ 3 (Package Registries & Containers): Te fli ɖe npm automation me eye nàta dzesiwo (-/.npmrc), PyPI API ƒe dzesiwo (-/.pypirc), Docker Hub / GHCR / ECR ƒe gege ɖe eme ƒe dzesiwo (-/.docker/config.json), kple Terraform Cloud ƒe dzesiwo (-/.terraform.d/credentials.tfrc.json).
7. Kpɔ npm, PyPI, Cargo, kple GitHub FIFIA be nàkpɔe ɖa be malware la mezã wò nutoa me dzesiwo xoxo tsɔ ta wò ŋutɔ wò packages ƒe tɔtrɔ si me nudzodzoewo le alo atutu commits vɔ̃ɖiwo: Egbegbe supply-chain payloads (abe... ua-parser-js, . coa, . rc, . ctx, . lottie-player, kple ultralytics compromises) ŋutɔ parse amesi ŋu wowɔ nuvevii ƒe developer ƒe -/.npmrc, . -/.pypirc, kple -/.gitconfig be woata backdoored patch versions enumake na open-source alo ememe package ɖesiaɖe si developer la léa be na, alo awɔ GitHub Actions dɔwɔwɔ ƒe ɖoɖo ɣaɣlawo le developer ƒe nudzraɖoƒewo.
8. Scan dɔwɔwɔ ƒe nyatakakadzraɖoƒe ɖesiaɖe le dɔwɔƒea be nàtu nudzraɖoƒe blibo si woɖe ɖe go .env files, database connection strings, and hardcoded API keys: Hafi nàtutu dɔwɔƒea la, wɔ ŋɔŋlɔdzesi aɖe si mele Internet dzi o le mɔ̃ si woɖe ɖe aga la dzi be nàŋlɔ ɖesiaɖe .env, . .env.local, . terraform.tfstate, kple application.yml faɛl si le wò hard drive dzi ale be nàte ŋu atrɔ ame etɔ̃lia ƒe nya ɣaɣla ɖesiaɖe (Stripe, Twilio, SendGrid, OpenAI, Anthropic, Datadog, Slack, Postgres, MongoDB, kple Redis ƒe ɖaseɖigbalẽwo) si wò zãla ƒe akɔntabubu ate ŋu axlẽ.
9. Tɔ browser ƒe ɣeyiɣiwo katã kple hardware wallet kadodowo nu: Esi wònye be developer ƒe nugblẽfexeɖoɖowo dea adzɔnuwo infostealers (abe Lumma, RedLine, alo Atomic macOS Stealer ene) ɖe developer-specific credential harvesters xa enuenu ta la, dze míaƒe... session cookie hijacking kple infostealer dzesiwo ɖeɖeɖa ƒe mɔfiame eye, ne èwɔ Web3 ƒe ŋgɔyiyi alo nèlé dijitaal nunɔamesiwo ɖe asi la, wɔ míaƒe cryptocurrency gakotoku drain kple nuku nyagbe nugblẽfexexe mɔfiame.

--- .

Nyametsotso ƒe ati: developer dɔwɔƒe ƒe nuzazã-kɔsɔkɔsɔ ƒe nugblẽfexexe ƒe vovototodedeameme¶

Zã nudzɔdzɔwo ŋuɖoɖo ƒe dɔwɔwɔ ƒe ɖoɖo sia nàtsɔ alé blast radius la ɖe wò ŋutɔ wò ŋgɔyiyi ƒe nɔnɔme kple nuwɔwɔ ƒe dɔwɔƒe ƒe xɔtuɖoɖowo siaa me:

flowchart TD
    Detect["Wosusu be Npm / PyPI / Agbatsɔkeke, Trojanized IDE Kekeɖenudɔ, alo Aʋatso Amexɔla Repo Wowɔ"] --> Isolate["ATA 1: Ðe Dɔwɔƒe ƒe Wi-Fi & Ethernet ƒe Kadodoa ɖa Enumake (Na Mɔ̃a Nanɔ Dɔ wɔm hena Offline Triage)"]

    Isolate --> ScopeCheck{"Ðe Dɔwɔwɔ Dzɔ le Host OS alo Inside Isolated Container / VM mea?"}
    ScopeCheck -->|"Host OS (Mac / Linux / Windows / WSL2) ƒe dɔwɔƒe."| FullCompromise["Tsɔe be Woɖe Aƒeme Nyatakakadzraɖoƒe (-/.aws, -/.ssh, -/.npmrc, .env, Browser Cookies) ƒe 100% ɖa"]
    ScopeCheck -->|"DevAdzɔnu / Docker"| MountCheck["Kpɔ Volume ƒe Towo (-v -/.ssh, -v -/.aws, Docker Socket /var/run/docker.sock, alo Host Network) ɖa."]
    MountCheck --> FullCompromise

    FullCompromise --> CleanDevice["ATA 2: Tso Dzadzɛnyenye ƒe Mɔ̃ si Ðe Vovo me, Xlɔ̃ nu SOC & Te fli ɖe Alilikpo IAM, SSO, GitHub/GitLab, kple Ŋkɔŋlɔdzesiwo Me"]

    CleanDevice --> WormCheck["ATA 3: Dzro GitHub Commits, CI/CD Workflows, kple npm/PyPI Ta ƒe Tɔtrɔwo me hena Nudzodzoewo ƒe Kaka Siwo Wowɔ Le Wo Ðokui Si"]

    WormCheck --> OfflineAudit["ATA 4: Le Dɔwɔƒe si mele Internet dzi o la, Ŋlɔ .env Faɛlwo Katã, Terraform Dukɔa ƒe Faɛlwo, Kple Persistence Backdoors"]

    OfflineAudit --> RotateEnv["ATA 5: Trɔ Nyatakakadzraɖoƒe ƒe Nyagbe, Webhook Secret, GPG Signing Key, kple API Key ɖesiaɖe si wokpɔ le .env / State Files me"]

    RotateEnv --> RebuildOS["ATA 6: Tutu Dɔwɔƒea to Clean OS Reinstall dzi -> Zi Hardware-Backed SSH Keys, OIDC, kple --ignore-scripts dzi"]

--- .

Alesi developer supply-chain kple IDE vectors wɔa dɔe gɔmesese¶

Egbegbe amedzidzedze ɖe kɔmpiutadziɖoɖowɔlawo ŋu tɔa ŋku amewuwu ƒe teƒe vovovo ene siwo le dɔwɔƒe aɖe. Ne ède dzesi vektor si ƒo wò mɔ̃a la, egblɔa mɔnukpɔkpɔ kple faɛl mɔ siwo dzi payload la ge ɖo la na wò:

1. Nubabla Vɔ̃ɖiwo ƒe Agbenɔƒe ƒe Kɔsɔkɔsɔwo ( .npm, . pnpm, . yarn, . pip, . cargo, . gem) .¶

• Node.js (package.json scripts): Le gɔmedzedzea me la, ele du dzi npm install wɔa shell sedede ɖesiaɖe si woɖe fia le "preinstall", . "install", alo "postinstall" agblewo ƒe package.json, menye na top-level package si nèŋlɔ la ɖeɖeko o, ke boŋ na transitive dependency ɖesiaɖe le ati la me. Amedzidzelawo zãa typosquatting (e.g., . reqeusts, . crossenv, . lodahs), dependency confusion (dutoƒo agbalẽvi tata ɖe npm alo PyPI dzi kple ŋkɔ ɖeka tututu kple eƒe tɔtrɔ ƒe xexlẽdzesi si kɔ wu, abe 99.99.9, abe wò dɔwɔƒea ƒe ememe ame ŋutɔ ƒe agbalẽvi ene), alo maintainer account takeovers be nàtsɔ fli ɖeka aƒu gbe abe "postinstall": "node index.js" ɖe agbalẽvi aɖe me.
• Python (setup.py kple .pth files): Ɣekaɣie pip dea dzɔtsoƒe mama aɖe (sdist .tar.gz), ewua ame setup.py kple Python gbegɔmeɖela ƒe mɔnukpɔkpɔ blibowo. Ne wole tasiaɖamfɔ eve siwo woƒo ƒu do ŋgɔ dem (.whl) siwo mewɔa dɔ o setup.py le eɖoɖo me la, amedzidzelawo tsɔa ** vɔ̃ɖiwo dea eme..pth (mɔ ƒe ɖoɖowɔwɔ) faɛlwo** si woda ɖe eme tẽ site-packages/. Fli ɖesiaɖe si le a .pth faɛl si dze egɔme kple import nye esi Python gbegɔmeɖela la wɔna le eɖokui si ɣesiaɣi python dzea egɔme tso ɖoɖo ma dzi.
• Gbeɖuƒe (build.rs) kple Go: Le Rust me la, Cargo ƒoa nu ƒu le eɖokui si eye wòwɔa dɔ build.rs menye le ɣeyiɣia me ɖeɖeko o cargo build alo cargo run, gake enumake ne ** .rust-analyzer (le VS Code alo IntelliJ me)** ʋua dɔwɔwɔ ƒe agbalẽdzraɖoƒe na index ƒomeviwo. Ðeko nàʋu Rust nudzraɖoƒe si wowɔ le wò IDE me kple rust-analyzer enabled wɔa kɔpi si wodi le eme build.rs hafi nàŋlɔ terminal ƒe sedede aɖe gbeɖeka.

2. IDE ƒe kekeɖenudɔ vɔ̃ɖiwo alo esiwo woxɔ le ame si (VS Code Marketplace, OpenVSX, JetBrains) .¶

• Visual Studio ƒe Kɔda, Nufiamɔ̃, Yaƒoƒo, kple VSCodium ƒe kekeɖenudɔwɔwɔwo (.vsix) ƒu du le Node.js Extension Host ƒe dɔwɔwɔ vevitɔ me le wò dɔwɔƒe kple zero sandboxing. Extension ɖesiaɖe si woda ɖe wò kɔmpiuta dzi la ƒe nuxexlẽ/ŋɔŋlɔ ƒe mɔnukpɔkpɔ blibo le wò faɛlɖoɖo bliboa me, ate ŋu adzi ɖevi ƒe dɔwɔwɔ siwo me mekɔ o (child_process.exec), ate ŋu axlẽ nuŋlɔla ƒe buffer ɖesiaɖe si le ʋuʋu ɖi eye .env file, eye ate ŋu aƒo wò terminal si wotsɔ wɔ ɖekae la hook.
• Afɔkuwɔlawo taa aʋatso tanya ƒe kekeɖenudɔwɔwɔwo edziedzi (Darcula Official), aʋatso AI coding kpeɖeŋutɔwo, alo typosquatted linter/Prettier kekeɖenudɔ siwo ɖea afɔ evelia ƒe infostealer alo reverse shell le ɖoɖoezizi me le ɣeyiɣi si me IDE la dze dɔ gɔme.

3. Aʋawɔnuwo Git Nudzraɖoƒewo & IDE Dɔwɔƒe Auto-Wɔwɔwɔ ("Aʋatso Amexɔla / Kplɔ-Aƒe Dodokpɔ" Mɔ̃wo)¶

• Dziehe Korea ƒe ƒuƒoƒo siwo dziɖuɖua doa alɔe (Contagious Interview / . Lazarus Group) kple ŋɔdzinuwɔla siwo léa fɔ ɖe crypto ŋu la tena ɖe dɔwɔla siwo le LinkedIn, Upwork, alo GitHub dzi edziedzi hewɔa wo ɖokui abe amewo xɔxɔ ɖe dɔ me alo CTO siwo naa adzɔge akpa siwo woxea fe geɖe le ene. Wobia tso ewɔla si be wòawɔ Bitbucket alo GitHub nudzraɖoƒe ƒe nɔnɔmetata hena "aɖabaƒoƒo 15 ƒe vodadawo ɖɔɖɔɖo ƒe dodokpɔ" alo "Web3 fefe MVP ƒe ŋkuléle ɖe eŋu."
• Nudzraɖoƒe siawo me dɔwɔwɔ ƒe mɔ̃ ɣaɣla siwo ʋãna ne woʋui le IDE me alo le xɔtutu me:
• ** ** ..vscode/tasks.json kple "runOn": "folderOpen"**: Ewɔa megbenya ƒe ŋɔŋlɔdzesi le eɖokui si zi alesi nèzi "Ẽ, meka ɖe agbalẽŋlɔlawo dzi" dzi le VS Code me.
• Nu vɔ̃ɖi wɔwɔ .git/hooks/ alo .gitmodules: Ewɔa Git submodule ƒe ɖoɖowɔwɔ ŋudɔ alo tua ŋɔŋlɔdzesiwo (Makefile, . webpack.config.js, . next.config.js, . vite.config.ts) siwo tsɔa JavaScript ƒe fetu siwo me mekɔ o (zi geɖe la, wotsɔa teƒe akpe geɖe siwo le screen la godo be woatsɔ aɣla wo ɖokui ɖe sɔti 2,000+ dzi) yɔa gotagome C2 dɔdzikpɔla.

--- .

Akpa 1: Blibo Developer Credential & Adzame Trɔtrɔ Matrix¶

Zã kɔmpiutadziɖoɖo evelia alo asitelefon si le dzadzɛ, wɔ dɔ ɖe ɖoɖo nu to 12-point developer credential inventory sia dzi. Tsɔe be faɛl ɖesiaɖe si wò OS zãla ƒe akɔnta si menye root o ate ŋu axlẽ (chmod 600 alo 644 si nye wò zãla tɔ) la da ɖe amedzidzela la ƒe dɔwɔƒea le sɛkɛnd 3 me tso esime wowɔ payload la.

--- .

Akpa 2: Kpɔkpɔ le Automated Supply-Chain Worm ƒe kaka ŋu (GitHub, CI/CD & Package Registries) .¶

To vovo na kɔmpiutadziɖoɖo vɔ̃ɖi siwo wozãna le mɔ gbegblẽ nu la, wowɔ ɖoɖo ɖe fetu siwo ŋu dɔwɔlawo ɖo koŋ ŋu be woawo ŋutɔwo nakaka ɖe kɔmpiutadziɖoɖowo ƒe kɔsɔkɔsɔa me le sɛkɛnd ʋɛ aɖewo me tso esime woɖi ɖe wò dɔwɔƒe. Hafi nàtrɔ ayi wò kɔmpiutadziɖoɖoa dzadzraɖo dzi la, zã wò mɔ̃ si le dzadzɛ la nàtsɔ akpɔe ɖa be womezã wò ɖaseɖigbalẽ siwo wofi la xoxo tsɔ da dɔ le wò ƒuƒoƒoa alo wò dɔwɔƒe siwo le anyime ŋu o:

1. Dzro wò GitHub / GitLab Nudzraɖoƒewo me hena megbeʋɔtru siwo me ɖoɖoezizi le kple Dɔwɔɖoɖo vɔ̃ɖiwo:
2. Kpɔe ɖa .github/workflows/*.yml le nudzraɖoƒe siwo katã le asiwò me la, ŋlɔa mɔ ɖe: Recent supply-chain worms (Shai-Hulud, . tj-actions/changed-files nugblẽfexexe, kple ultralytics exploits) zãa developer token siwo wofi le eɖokui si tsɔ wɔa GitHub Actions ƒe dɔwɔwɔ ƒe ɖoɖo vɔ̃ɖi aɖe alo trɔa asi le dɔwɔwɔ ƒe ɖoɖo si li xoxo ŋu be wòatsɔ aƒu gbe ${{ toJSON(secrets) }} (wò habɔbɔ ƒe nuwɔwɔ ƒe dɔwɔwɔ ƒe nya ɣaɣlawo ɖeɖe tso GitHub Actions duƒulawo gbɔ).
3. Ðo kpe nyitsɔ laa ƒe commits dzi to agbalẽŋlɔla kple committer ƒe ɣeyiɣidzesi dzi: Nenɔ susu me na wò be amesiame ateŋu awɔ Git ŋlɔla ƒe ŋkɔ kple ɣeyiɣi ƒe dzesi (git commit --date="..." --author="..."). Le GitHub me la, lé ŋku ɖe Push Events le nudzraɖoƒe Dɔwɔwɔ ƒe kpɔkpɔ alo habɔbɔ Audit Log (repo.push), siwo ŋlɔa ɣeyiɣi ƒe dzesi vavãtɔ si le server-side kple ɖaseɖiɖi ƒe dzesi tututu (oauth_application_id alo ssh_key_fingerprint) si ƒoe ɖe kɔdasia nu.
4. Kpɔ Nudzraɖoƒe ƒe Webhooks, Deploy Keys, kple Collaborators: Kpɔ Settings > Webhooks, Settings > Deploy keys, kple Settings > Collaborators and teams te le wò nudzraɖoƒewo be nàkpɔ egbɔ be amedzidzela la metsɔ nuxexlẽ/ŋɔŋlɔ deploy key alo webhook si nɔa anyi ɖaa si fia asi gotagome dɔwɔƒe aɖe kpee o.
5. Dzro npm, PyPI, Cargo, kple Docker Hub me hena Package ƒe dodo siwo ŋu womeɖe mɔ ɖo o:
6. Ne ènye beléla alo dɔwɔhati le dutoƒo alo ame ŋutɔ ƒe agbalẽvi ɖesiaɖe dzi le npm, PyPI, RubyGems, alo Crates.io la, kpɔ Versions / Release History ƒe tab na agbalẽvi ɖesiaɖe si le wò akɔnta te.
7. Ne patch version (le kpɔɖeŋu me, . 1.4.2 le wò asiɖeɖe le ŋuwò zi mamlɛtɔ le se nu megbe 1.4.1) wota le ɣeyiɣi si me wò dɔwɔƒe ƒe nugblẽfexeɖoɖoa me, ɖe asi le tɔtrɔ ma ŋu enumake alo yank (npm deprecate <pkg>@<version> "CRITICAL: Compromised version, do not use" alo yank le PyPI) eye nàƒo ka na npm Kpekpeɖeŋu (security@npmjs.com / GitHub Dedienɔnɔ) alo PyPI Dedienɔnɔ (security@pypi.org) be woaɖe asinudɔwɔwɔ vɔ̃ɖi la ɖa eye woaɖe tɔtrɔ siwo ŋu wògblẽ nu le la ɖa.
8. **Kpɔe ɖa be Adzame TruffleHog / Git Clone Exfiltration **:
9. Nuzazãwo ƒe kɔsɔkɔsɔ fiafitɔwo yɔa GitHub/GitLab API enuenu to wò dzesi si wofi la zazã me tsɔ wɔa habɔbɔ ƒe nudzraɖoƒe ɖesiaɖe si nye ame ŋutɔ tɔ si ŋu nète ŋu ɖo la ƒe nɔnɔmetata eye wowɔa adzame scanner siwo wowɔna le wo ɖokui si (TruffleHog alo Gitleaks) tsi tre ɖe wò dɔwɔƒea ƒe commit ŋutinya bliboa ŋu. Ne wò habɔbɔa tsɔ nya ɣaɣla aɖe de asi na ame ŋutɔ ƒe nudzraɖoƒe aɖe ƒe Git ŋutinya le vo me kpɔ evɔ mètrɔe o la, trɔ ŋutinya ɣaɣla mawo fifia.

--- .

Akpa 3: Offline Forensic Triage le Dɔwɔƒe si Wogblẽ Nu le¶

Esi wò dɔwɔƒe ɖe kadodo ɖa keŋkeŋ tso Wi-Fi kple Ethernet gbɔ la, ʋu terminal fesre aɖe be nàwɔ offline triage. Wò taɖodzinua nye nu eve: (A) di ɖesiaɖe .env kple ɖoɖowɔɖi ƒe faɛl le disk la dzi ale be nànya nya ɣaɣla siwo nàtrɔ, eye (B) alé kpeɖodzi siwo ɖe nusi tututu package alo extension vɔ̃ɖi la wɔ hafi nàtutu dɔwɔɖoɖoa.

Afɔɖeɖe 1: Nudzraɖoƒe ɖesiaɖe si Woɖe Ðe Go .env, Private Key, kple Dukɔa ƒe Faɛl si le Wò Disk Dzi¶

Wɔ sedede sia si woate ŋu axlẽ ko la le wò macOS, Linux, alo WSL2 dɔwɔƒe si mele Internet dzi o dzi be nàwɔ teƒea ƒe faɛl ɖesiaɖe si me nya ɣaɣla siwo malware la ate ŋu axlẽ hafi la ƒe ɖaseɖigbalẽ blibo:

# Create an offline audit list of all .env files, Terraform states, kubeconfigs, and private keys in your home directory:
find ~ -maxdepth 5 \( \
    -name ".env" -o \
    -name ".env.*" -o \
    -name "*.tfstate" -o \
    -name "*.tfstate.backup" -o \
    -name "*.pem" -o \
    -name "*.key" -o \
    -name "*.p12" -o \
    -name "*.pfx" -o \
    -name "*service-account*.json" -o \
    -name "credentials.json" -o \
    -name ".npmrc" -o \
    -name ".pypirc" -o \
    -name ".netrc" \
\) -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/Library/Caches/*" 2>/dev/null > ~/exposed_secrets_inventory.txt

cat ~/exposed_secrets_inventory.txt

To eme -/exposed_secrets_inventory.txt fli ɖesiaɖe eye nàʋu ɖesiaɖe .env alo .tfstate file offline ale be nàte ŋu atrɔ API safui ɖesiaɖe, nyatakakadzraɖoƒe ƒe nyagbe ɣaɣla, kple webhook nya ɣaɣla si woŋlɔ ɖe wo me tso wò mɔ̃ dzadzɛa dzi.

Afɔɖeɖe 2: Lé ŋku ɖe Nusi Dɔwɔnu Vɔ̃ɖi alo IDE ƒe Kekeɖenudɔa Wɔ ŋu¶

Hafi nàtutu agbalẽdzraɖoƒe si do dziku na wò la, lé ŋku ɖe payload la tututu ŋu eye nàlé ŋku ɖe afisi wòda persistence ɖe wò dɔwɔɖoɖoa dzi le:

# 1. Inspect package.json lifecycle scripts in the suspect project and its node_modules:
grep -rnE '"(preinstall|install|postinstall|prepublish|prepare)"' ./package.json ./node_modules/*/package.json ./node_modules/@*/*/package.json 2>/dev/null

# 2. Check Python site-packages for malicious .pth startup hook files:
find . -path "*/site-packages/*.pth" -exec head -n 20 {} + 2>/dev/null

# 3. Inspect recently installed or modified VS Code / Cursor / Windsurf Extensions:
ls -lt ~/.vscode/extensions/ ~/.cursor/extensions/ ~/.windsurf/extensions/ 2>/dev/null | head -n 30

# 4. Check for persistence injected into your Shell RC profiles and Git global hooks:
tail -n 30 ~/.zshrc ~/.bashrc ~/.bash_profile ~/.zprofile ~/.profile 2>/dev/null
git config --global --list | grep -E "core.hooksPath|alias|credential|filter"

Afɔɖeɖe 3: Di OS-Level Madzudzɔmadzudzɔe si Developer Malware (macOS, Linux, kple Windows) Da .¶

Nusiwo dzi woanɔ te ɖo vɔ̃ɖi kple "aʋatso amexɔla" nudzraɖoƒewo tsɔa megbenyawo ƒe dɔwɔla siwo nɔa anyi ɖaa siwo woɣla abe ɖoɖo yeyewɔlawo, Node gbɔgbɔ vɔ̃wo, alo Spotlight indexers ene la ƒua gbe enuenu:

• Le Apple macOS dzi:

  # 1. Check user and system LaunchAgents / LaunchDaemons for recently added .plist files:
  ls -laht ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
  
  # 2. Check active cron jobs and running background node/python/curl/nohup processes:
  crontab -l
  ps aux | grep -iE "node|python|osascript|curl|wget|nc|bash -i|/tmp/|/var/tmp/|Library/Application Support"
  

• **Le Linux / Ubuntu / Fedora / WSL2 dzi **:

  # 1. Check user systemd services, cron jobs, and SSH authorized_keys:
  ls -la ~/.config/systemd/user/ /etc/systemd/system/
  crontab -l
  cat ~/.ssh/authorized_keys
  
  # 2. Check running processes executing out of /tmp, /dev/shm, or ~/.cache:
  ls -la /proc/*/exe 2>/dev/null | grep -E "/tmp/|/dev/shm/|\.cache|\.local"
  

• Le Windows (WSL2 ƒe Dzɔdzɔme alo Host):
• Ðo ŋku edzi be npm alo Python ŋɔŋlɔdzesi vɔ̃ɖi si le dɔ wɔm le WSL2 (Windows Subsystem for Linux) me ateŋu age ɖe wò Windows host bliboa me tẽ C:\ ʋu to ** dzi./mnt/c/Users/<username>/** eye ate ŋu ayɔ ** .powershell.exe** alo ** .cmd.exe** tẽ tso Linux ƒe goa me be wòaxɔ dɔ le Windows host Registry (HKCU:\Software\Microsoft\Windows\CurrentVersion\Run), Dɔwɔwɔ Siwo Wowɔ Ðoɖo Ðo, kple Chrome/Edge Cookies nyatakakadzraɖoƒewo.
• Ƒu du Windows PowerShell ƒe madzudzɔmadzudzɔe ƒe agbalẽdzikpɔkpɔ bliboa le míaƒe session cookie hijacking kple infostealer mɔfiame kple míaƒe malware, ransomware, kple spyware dɔlékuiwo ŋuti mɔfiame.

--- .

Akpa 4: Nusita Wòle Be Nàtutu Developer Dɔwɔƒea Agbugbɔ Atu¶

Ne èke ɖe vɔ̃ɖitɔawo ŋu hetutu wo ɖa gɔ̃ hã node_modules agbalẽdzraɖoƒe, si nye .vsix kekeɖenudɔ, kple ameflula aɖe -/Library/LaunchAgents plist, mele be nàyi edzi azã developer workstation si ŋu woɖe mɔ ɖo gbeɖe na production engineering ne mèwɔ OS wipe dzadzɛ kple reinstall o.

Payload deŋgɔ siwo woɖo taɖodzinu na dɔwɔla la trɔa asi le binary alo ɖoɖowɔɖi ƒe faɛl siwo le se nu xoxo siwo le wò kɔmpiuta dzi siwo antivirus scanner aɖeke meɖea dzesi be wonye nu gbegblẽ o: 1. Trojanized Nutoa me CLI Binaries (git, . ssh, . sudo, . aws, . kubectl, . docker): Payload si le dɔ wɔm le wò zãla ƒe akɔnta te mateŋu aŋlɔ ɖe edzi o /usr/bin/ssh manɔmee sudo, eyata boŋ etsɔa agbalẽ xatsaxatsa ƒe nuŋɔŋlɔ ɖe ** .-/.local/bin/ssh, ** .-/bin/git, alo ** .-/bin/sudo** eye wòtsɔa agbalẽdzraɖoƒe ma doa ŋgɔ na wò PATH. Ɣebubuɣi si nàŋlɔ nu sudo alo ssh -i ne ègaɖo internet dzi ake vɔ la, agbalẽ xatsaxatsaa xea mɔ na wò nyagbe alo nyagbe si nèzãna le ɖoɖoezizi me eye wòɖonɛ ɖe amedzidzela la hafi yɔa binary ŋutɔŋutɔ. 2. Nutoa me Package Caches siwo me Dɔlékuiwo Le (-/.npm/_cacache, . -/.cache/pip, . -/.cargo/registry, . -/Library/Caches/pnpm): Malware ate ŋu ade aɖi tarball siwo wodzra ɖo ɖe wò nutoa me package manager cache me ale be ne ède package dzadzɛ si le se nu le kwasiɖa si gbɔna me gɔ̃ hã la, wò package manager aɖe tarball si le megbeʋɔtru la ɖa le wò local cache me. 3. IDE ƒe Nu veviwo ƒe Faɛl siwo ŋu wotrɔ asi le (workbench.desktop.main.js): VS Code kple Cursor payload aɖewo ƒoa Electron la tẽ asar nudzraɖoƒe alo workbench.desktop.main.js le IDE dɔwɔɖoɖo ƒe babla la me ale be megbeʋɔtrua natsi agbe ne woɖe kekeɖenudɔawo katã ɖa.

Wɔ kɔpi na dzɔtsoƒe ƒe kɔpi dzadzɛ ko (woɖo kpe edzi to git status kple git diff le mɔ̃ dzadzɛ dzi) kple ame ŋutɔ ƒe nuŋlɔɖiwo, emegbe nàwɔ clean macOS Erase All Content and Settings / DFU Restore, Linux USB ɖoɖo dzadzɛ, alo Windows 11 USB ɖoɖo dzadzɛ.

--- .

Wò Developer Yeye Dɔwɔƒea ƒe Sesẽ ɖe Etsɔme Nuzazãwo ƒe Kɔsɔkɔsɔwo ƒe Amedzidzedzewo Ŋu¶

Ne èle wò developer dɔwɔƒe si wotutu yeyee ɖom la, tsɔ dɔwɔwɔ siwo ŋu hardware-backed, ephemeral, kple sandboxed workflows ɖɔ li static plaintext files le wò aƒeme directory me ale be ne vɔ̃ɖitɔ aɖe si dzi woanɔ te ɖo awɔ dɔ le etsɔme gɔ̃ hã la, zero static secrets le disk dzi be wòafi:

1. Trɔ asi le Automatic Lifecycle Script Execution ŋu le Package Managers me¶

Ðoɖowɔwɔ ɖe eŋu npm, . pnpm, . yarn, kple pip eyata nusiwo dzi womeka ɖo o mateŋu awɔ shell scripts le ɖoɖoezizi me le eɖoɖoɣi o: - Node.js (npm / . yarn / . pnpm):

# Globally disable automatic preinstall/postinstall script execution in npm:
npm config set ignore-scripts true

# Refuse to run arbitrary setup.py scripts from source distributions (.tar.gz); require binary wheels only:
export PIP_ONLY_BINARY=":all:"

2. Ðe Nuŋɔŋlɔ Gãwo ɖa -/.ssh/id_ed25519, . -/.aws/credentials, kple .env Fail siwo tso Disk dzi¶

• Tsɔ SSH Safuiwo yi Hardware YubiKey me (ed25519-sk) alo Enclave Dedie / Biometric Dɔwɔla:
• Mègagblẽ nya si wometsɔ nya ɣaɣlawo ŋlɔ o alo esi me nyagbe ɣaɣla aɖeke mele o ɖi gbeɖe o -/.ssh/id_ed25519 faɛl si le disk dzi. Alo wɔ hardware-nɔƒe FIDO2 SSH safui (ssh-keygen -t ed25519-sk -O verify-required) le YubiKey ŋutɔŋutɔ dzi (si bia be wò asibidɛ ŋutɔŋutɔ ka asi ga ƒe kadodoa ŋu na ɖesiaɖe git push alo ssh kadodo), alo dzra wò SSH safuiwo ɖo ɖe 1Password SSH Agent / Secretive (macOS Secure Enclave) me afisi ame ŋutɔ ƒe safui meli gbeɖe abe faɛl ene le -/.ssh/ eye asidede agbalẽ te ɖesiaɖe bia be yeawɔ Touch ID / Windows Hello.
• Tsɔ Static ɖɔ li -/.aws/credentials (AKIA...) kple SSO si Nɔa Agbe Kpuie (aws sso login alo aws-vault):
• Tutu IAM zãla ƒe mɔɖeɖe ƒe safui siwo katã nɔa anyi ɖaa (AKIA...). Zã AWS IAM Dzesidede Dɔwɔƒe (aws sso login) kple ɣeyiɣi kpui siwo woatsɔ awɔ dɔe (gaƒoƒo 1 va ɖo 4) alo abla ɖaseɖigbalẽwo ɖe eme ** .aws-vault** wotsɔ macOS Keychain / Windows Credential Manager kpe ɖe eŋu kple biometric ƒe nyabiasewo.
• Tsɔ Nuŋɔŋlɔ gbadzaa ɖɔ li .env Fail siwo me Runtime Secret Injection le (1Password CLI op run, . Doppler, alo aws-vault):
• Le esi teƒe be woadzrae ɖo STRIPE_SECRET_KEY=sk_live_... le nuŋɔŋlɔ si me kɔ me .env file be any node_modules script ate ŋu fs.readFileSync('.env'), fiase me nyatakakawo abe STRIPE_SECRET_KEY="op://Dev-Vault/Stripe/secret_key" eye nàdze wò nutoa me dev server gɔme to ** .op run --env-file=".env.template" -- npm run dev** le nyateƒetoto kple Touch ID megbe.
• Zã Agbalẽtata si Dzi Woka Ðo (OIDC) tsɔ wu be nàzãe si anɔ anyi didi -/.npmrc kple -/.pypirc Dzesiwo:
• Mègatsɔ dzesi si ate ŋu ata nu ɖo eme gbeɖe o -/.npmrc alo -/.pypirc le wò kɔmpiuta dzi. PyPI kple npm (to Provenance / OIDC) siaa ɖe mɔ na wò be nàta agbalẽviwo tso GitHub Actions / GitLab CI Trusted Publishers siwo woɖe ɖe aga ɖeɖeko me to OpenID Connect (OIDC) dzesi siwo nɔa anyi ɣeyiɣi kpui aɖe zazã me, si fia be zero publish tokens nɔa beléla ɖesiaɖe ƒe kɔmpiuta dzi kpɔ.

3. Ðe Nudzraɖoƒe Siwo Dzi Womeka Ðe O Ðe Vo eye Tu Scriptwo Le DevContainers alo VM sesẽwo Me¶

• Mègawɔ clone eye nàwɔ "Recruiter Take-Home Assessment", open-source project si mènya o, alo bounty repo tẽ le wò host OS dzi gbeɖe o:
• Wɔ dɔ siwo mènya o le GitHub Codespace, alilikpo VM si woate ŋu atsɔ aƒu gbe, alo teƒea ƒe Docker DevContainer si NOT bind-mount wò host home directory me (-), mewɔa MENYE todzi o /var/run/docker.sock, eye wòtoa Git dzesi si ƒe kekeme le, si woate ŋu axlẽ ko dzi ne ehiã.
• Dzro VS Code / Cursor Extensions me eye nàdzudzɔ Auto-Updates na Gbeƒãɖela Siwo Womeɖo Kpe O:
• Ðo ŋku edzi be Cursor, Windsurf, kple VSCodium hea kekeɖenuwo tso OpenVSX Registry (open-vsx.org) tsɔ wu Microsoft ƒe Visual Studio Asitsaƒe si dziɖuɖua da asi ɖo. Kpɔ gbeƒãɖela ƒe ŋkɔteƒe tututu eye nàda xexlẽme si nèda ɖe wò kɔmpiuta dzi hafi nàda kekeɖenudɔ ɖesiaɖe ɖe wò kɔmpiuta dzi, na wò kekeɖenudɔwɔwɔ ƒe xexlẽdzesi si nèda ɖe wò kɔmpiuta dzi nanɔ sue wu, eye nàɖe kekeɖenudɔ siwo mègazãna vevie o la ɖa.

--- .

Nya siwo wobiaa amewo enuenu¶

Ewɔa duƒuƒu npm install --ignore-scripts kpɔ tanye keŋkeŋ tso npm package vɔ̃ɖi aɖe mea?¶

Duƒuƒu npm ɖo --ŋe aɖaba ƒu-ŋɔŋlɔwo dzi xea mɔ na nuzazãwo ƒe kɔsɔkɔsɔ ƒe amedzidzedze vector si bɔ wu: automatic execution of do ŋgɔ na wò ɖoɖo, . tsɔe de eme, kple postinstall megbe shell sedede siwo woɖe le eme package.json ƒe agbalẽ le eɖoɖoɣi. Gake mekpɔa tawò ne ènya wɔ agbalẽvi la ƒe JavaScript kɔpi ŋutɔŋutɔ ko (le kpɔɖeŋu me, ne èle dɔ wɔm o npm ƒu du dev, . npm dodokpɔ, . fefenyawo gbɔgblɔ, . webpack ƒe agbalẽ, alo vite, alo ne wò IDE ƒe ESLint/TypeScript plugin tsɔ plugin vɔ̃ɖi aɖe tso node_modules ƒe dɔwɔwɔ). Esi wònye be Node.js mekpɔa runtime filesystem alo network sandbox le gɔmedzedzea me o ta la, code ɖesiaɖe si wotsɔ va le wò xɔtutu alo dodokpɔ ƒe afɔɖeɖea me ateŋu axlẽ kokoko -/.aws kple -/.ssh negbe ɖe nèɖe xɔtutua ɖe vovo le nugoe aɖe me alo zã Node ƒe dodokpɔ mɔɖeɖe ƒe kpɔɖeŋu (node --mɔɖeɖe).

Meʋu nudzraɖoƒe aɖe si ŋu ɖikeke le le VS Code me tso ame aɖe si xɔa amewo ɖe dɔ me gbɔ le LinkedIn, eye mezi "Ẽ, meka ɖe agbalẽŋlɔlawo dzi" dzi hafi mekpɔe be ametafatafae. Did code execute ne nyemeƒu du kpɔ o gɔ̃ hã npm install?¶

Ẽ, ele be nàtsɔe be wowɔ kɔda si nèdi le sɛkɛnd si tututu nèzi "Ẽ, meka ɖe agbalẽŋlɔlawo dzi." Le Visual Studio Code kple Cursor me la, nana be Workspace Trust naɖe mɔ na nudzraɖoƒea ƒe .vscode/dɔwo.json file be woawɔ megbenya shell dɔ siwo woɖo kplii "runOn": "agbalẽdzraɖoƒea Ʋu"., ɖe mɔ ɖe dɔwɔwɔ ƒe teƒe si woɖe fia ŋu .vscode/ɖoɖowo.json be wòafia asi gbegbɔgblɔ ƒe dɔwɔƒewo (abe Python, TypeScript, ESLint, alo Rust Analyzer) ɖe mɔ gbegblẽ siwo woate ŋu awɔ le nudzraɖoƒea ƒe agbalẽdzraɖoƒea me, eye wòaʋã dɔwɔwɔ le eɖokui si ƒe xɔtu.rs le Rust dɔwo me. Ðe mɔ̃a ɖa le network la ŋu enumake eye nàwɔ ɖe Akpa 1 lia dzi be nàtrɔ ɖaseɖigbalẽwo katã.

Ne npm alo PyPI agbalẽvi vɔ̃ɖi la ƒu du le Docker nugoe alo DevContainer me la, ɖe nye host Mac alo Windows laptop le dediea?¶

Enɔ te ɖe volume mounts, environment variables, kple sockets siwo wotsɔ yi nugoe ma me dzi bliboe. DevContainer ƒe nɔnɔmetata siwo wozãna ɖaa kple nutoa me tɔ docker-kpa.yml setups zi geɖe auto-forward wò host SSH_AUTH_SOCK ƑE NUÐEÐEŊUTI (si ɖea mɔ na malware si le nugoe me be wòazã wò host ƒe SSH safuiwo atsɔ aƒo ka kple adzɔge serverwo alo atutu ɖe GitHub), bind-mount -/.aws, . -/.gitconfig ƒe ɖoɖo, alo wò dɔwɔƒe .env faɛlwo, alo nàdo host Docker socket (/var/ƒu du/docker.sock), si naa root ƒe mɔɖeɖe enumake yia host dɔwɔɖoɖo bliboa me. Dzro wò devcontainer.json ƒe nudzraɖoƒe kple docker ƒe ŋkuléle ɖe nu ŋu mounts be woakpɔ host resources siwo tututu woɖe ɖe go le nugoe la me.

Aleke mawɔ akpɔe ɖa be package version si me le ɖoɖo wɔm ɖe eŋu la ɣla install scripts alo obfuscated telemetry hafi maɖoe?¶

Hafi nàde npm, PyPI, Go, alo Rust package si mènya o la, lé ŋku ɖe eŋu Socket.dev. ƒe agbalẽ alo Deps.dev (to Google Open Source Insights dzi), siwo dzroa tɔtrɔ ɖesiaɖe me le teƒe ɖeka hena install scripts, network requests, filesystem access, .eval () . tɔtɔ, kple beléle na ame ƒe tɔtrɔ. Àte ŋu aƒu du hã npm view ŋɔŋlɔdzesiwo le wò terminal me be nàlé ŋku ɖe eƒe agbenɔƒe ƒe ŋɔŋlɔdzesiwo ŋu evɔ màɖe agbalẽvi la alo awɔ wo o.

--- .

Wolé ŋku ɖe dzɔtsoƒewo ŋu¶

• Internet Dzi Dedienɔnɔ Kple Dɔwɔƒewo ƒe Dedienɔnɔ Dɔwɔƒe (CISA) & Dukɔa ƒe Dedienɔnɔ Dɔwɔƒe (NSA) (United States): Kɔmpiutadziɖoɖowo ƒe Dɔwɔƒea ƒe Dedienɔnɔ: Nuwɔna Siwo Wokafu na Dɔwɔlawo Kple Nuwɔwɔ Ðe Nusiwo Dzi Woka Ðe Ŋu si Wogblẽ Ŋu.
• GitHub Security Lab & npm Dedienɔnɔ Ŋuti Aɖaŋuɖoɖowo: Nuwɔwɔ na npm Packages siwo Wogblẽ, Nu Vɔ̃ɖi .vscode/tasks.json Nudzraɖoƒe ƒe Mɔ̃wo (Contagious Interview), kple GitHub Actions Workflow Adzame Exfiltration Mitigations.
• Python ƒe Nubablɛwo Ŋuti Dɔwɔƒe (PyPA) & PyPI Dedienɔnɔ: Tasiaɖam Vɔ̃ɖiwo Dzi Kpɔkpɔ .pth Faɛlwo, . setup.py Amewuwu le Vome, Kple Agbalẽtata si Dzi Woka Ðo (OIDC) Mɔfiamewo le Dɔwɔwɔ Ŋu.
• Ʋu Xexeame Katã ƒe Dɔdamɔnu Dedienɔnɔ Dɔwɔɖoɖo (OWASP): *Software Supply Chain Dedienɔnɔ Cheat Sheet & CI / CD Dedienɔnɔ Top 10 Afɔkuwo *.
• Dukɔa ƒe Internet Dzi Dedienɔnɔ Dɔwɔƒe (NCSC) (United Kingdom): Developer Nutomewo kple Alilikpo Dzikpɔkpɔ Yameʋuwo Taʋiʋli Tsi Taɖodzinu ƒe Ðaseɖigbalẽwo Nuŋeŋe.

--- .

Mɔfiame siwo do ƒome kplii¶

• Session cookie hijacking, infostealers, kple dzesiwo ɖeɖeɖa
• Cryptocurrency gakotoku ƒe tsidzɔƒe kple nuku nyagbe ƒe nugblẽfexexe
• Browser ƒe kekeɖenudɔ vɔ̃ɖiwo, clipboard hijackers, kple adware ɖeɖeɖa
• Aʋatso dɔwɔwɔ ƒe ametafatafa, dɔwɔnuwo me toto ƒe ametafatafa, kple ame ƒe ŋkɔ fifi le ʋua me
• Malware, ransomware, kple spyware dɔlékuiwo
• Xexlẽdzesi siwo woxɔna kpata le dukɔwo nu