Trojan Hid in Fake Font File, Compromised 18 Repos Over 77 Days Undetected

·1 views

A developer discovered a trojan on 6 September 2026 after an antivirus quarantined a 32 KB file disguised as a Font Awesome font in a project's public folder. The malware had been active since 22 June, silently operating for 77 days across 18 repositories spanning three GitHub organisations, including client projects. It worked by hiding malicious JavaScript in VS Code task configuration files and build config files, executing automatically whenever a folder was opened or a build was triggered. The trojan had access to SSH keys, environment files containing payment and database credentials, browser-saved passwords, and deployment secrets throughout the infection period. Remediation required not just cleaning the affected machines but revoking all SSH keys, tokens, and credentials that may have been copied during the intrusion.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Releases Frost Deep Learning Framework Built in Just 1,400 Lines of Code

A developer has launched Frost, a deep learning framework built on the Neve programming language, containing roughly 1,400 lines of code that support parallel dataloaders and GPU kernels. The project was motivated by frustrations with PyTorch's complexity, including difficulties adding custom optimizers, poor high-level CUDA interoperability, and limited parallelism support. Frost includes a ResNet-18 benchmark that users can run independently, and Neve has previously shown performance competitive with NumPy, OpenBLAS, and Python's SentencePiece library. The developer is currently working on an improved GPU programming interface aimed at implementing flash attention. Source code, documentation, and community channels have been made publicly available on GitHub and Discord.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Disputes AI Labels of 'Malicious Actor' After Fixing npm Package Vulnerability

A developer known as bananacool467 disclosed that early beta versions (0.1.0–0.1.8) of their npm package UI Tools contained a serious security vulnerability due to insufficient authentication controls on a terminal feature. The flaw has since been patched, and the current release (0.2.1-beta) adopts a stricter security model with the terminal functionality moved out of the default export. The developer is now challenging AI-generated descriptions — particularly from Google Gemini — that repeatedly label them a 'malicious actor' based on outdated or inaccurate security database entries, including a reference to version 1.0.0 that does not exist in the package's npm history. They argue that some security databases have overstated the threat by implying install-time execution, which does not reflect how UI Tools actually works, and that unrelated projects under their account are being flagged without independent verification. The developer maintains a clear distinction between making a security mistake and acting with malicious intent, and is calling for more accurate representation by both AI systems and security databases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DEV Community Crowns Winners of Frontend Challenge: Comfort Food Edition

DEV Community has announced the winners of its Frontend Challenge: Comfort Food Edition. A pure CSS cat bakery project claimed the top spot in the competition. The results were shared by the DEV Team on September 10. The challenge drew significant engagement, garnering 47 reactions from the community. The event was tagged under frontend and CSS development themes, highlighting creative use of web technologies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Seven Security Vulnerabilities That Appear More Often in AI-Generated Code

A developer building a static analysis tool called ai-vuln-scan identified seven recurring vulnerability patterns that appear disproportionately in code produced by AI coding assistants like GitHub Copilot and Claude Code. The patterns include hardcoded secrets, unparameterized SQL queries, shell command injection via string interpolation, and overly permissive default configurations. Weak cryptographic primitives, inconsistent authorization across similar routes, and verbose error responses that expose internal details round out the list. The author argues these flaws stem not from AI incompetence but from the fact that AI tools optimize for plausible, runnable examples rather than production-hardened code. To address this systematically, the developer published an open-source tool and a versioned AI Vulnerability Pattern Catalog intended to help teams catch these predictable gaps in review.

0 comments Read more at DEV Community