ctrl/tinycolor and 40+ NPM Packages Compromised - StepSecurity
A pretty impressive and concerning compromise of a lot of JavaScript (and by extension TypeScript) packages.
"Four months ago, Adnan Khan and I exploited a critical CI/CD vulnerability in PyTorch, one of the world’s leading ML platforms. Used by titans like Google, Meta, Boeing, and Lockheed Martin, PyTorch is a major target for hackers and nation-states alike.
Thankfully, we exploited this vulnerability before the bad guys.
Here is how we did it."