Backdoored npm Packages Used Bun Runtime to Steal Secrets and Self-Propagate

·2 views

On November 24, 2025, security researchers identified hundreds of backdoored npm packages that silently downloaded the Bun JavaScript runtime during installation to evade standard Node.js monitoring tools. The malicious packages, found under well-known scopes including Zapier, Postman, and PostHog, used a preinstall hook to fetch Bun and execute a heavily obfuscated payload in the background. The payload deployed TruffleHog to scan for credentials, queried cloud metadata services on AWS, Azure, and Google Cloud, and exfiltrated stolen data to GitHub repositories created in victims' own accounts. Using stolen npm tokens, the worm then injected itself into up to 100 of each compromised maintainer's packages and republished them, effectively spreading itself further. Datadog reported over 796 backdoored packages affecting more than 500 GitHub users and 150 organisations, while Socket placed the count at over 500 packages, with the last known malicious publish recorded at 6 p.m. UTC on November 24.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build a Private AI Codebook Generator Using Mistral and FastAPI

A new tutorial from Gate of AI outlines a privacy-focused qualitative research workflow using Mistral Small 3.1, Ollama, and FastAPI to help researchers generate thematic codebook entries from interview or survey data. The guide is designed for teams handling sensitive text who require greater control than cloud-based tools typically allow. Mistral Small 3.1 is a 24-billion-parameter model that also served as the parent for the Ministral 3 family through pruning and distillation. The tutorial is explicitly framed as a planning blueprint rather than a ready-to-run deployment, cautioning developers to verify model identifiers, API endpoints, and hardware requirements against official documentation before writing production code. It also stresses that while local AI can propose candidate codes and organize excerpts, it cannot independently validate research conclusions or establish causality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Most Proptech AI Pilots Fail Before Reaching Production

AI adoption in property management rose sharply from 20% to 58%, yet only 8% of processes are fully automated, and a 2025 MIT report found 95% of generative AI pilots generated no profit. In commercial real estate, 92% of firms ran an AI pilot but just 5% met all their goals, a gap engineers attribute to structural flaws rather than model quality. Pilots typically run against clean, sandboxed data, while production systems require authentication boundaries, audit trails, and write paths back into legacy systems — none of which most pilots account for. Key barriers include change management (76%), data integrity failures from unpopulated schema fields (49%), and legacy system limitations (28%), with integration described as the core challenge since 73% of proptech tools must connect to pre-existing infrastructure. Engineers recommend resolving read and write paths, entity resolution, and identity models before signing vendor contracts, and favour a read-replica architecture that defers writes to a later phase.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Three Ways to Convert a Char to String in Java: Performance and Trade-offs

In Java, converting a primitive char to a String object is a common task that can affect performance and memory usage, particularly inside high-frequency loops. The three standard methods are Character.toString(char), String.valueOf(char), and the concatenation shorthand "" + char, each with distinct readability and memory characteristics. Character.toString() is explicit and readable, while String.valueOf() is widely recommended for general primitive-to-string conversions. The concatenation approach is quick to write but may generate garbage collector pressure in intensive iterative operations. Understanding how the JVM allocates memory differently for stack-based primitives and heap-based String objects helps developers choose the most appropriate method for their use case.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Are the New Security Blind Spot Keeping SOC Teams Up at Night

Organizations are deploying AI agents at scale to automate tasks like software development, customer support, and data analysis, but each agent carries its own digital identity that requires security oversight. Unlike human users, these non-human identities — including service accounts, API keys, and automated workflows — can operate around the clock and make thousands of API calls with minimal human supervision. Traditional identity security frameworks built around employee accounts are proving insufficient to monitor this expanding attack surface. Security teams now need behavioral analytics to distinguish normal agent activity from anomalous patterns, such as unexpected database access, privilege escalation, or data transfers to unknown endpoints. The challenge for Security Operations Centers is correlating these signals across logs and systems to detect when a legitimate AI identity may have been compromised or is acting outside its intended scope.

0 comments Read more at DEV Community