Engineer

Engineer | News, how-tos, features, reviews, and videos

Malicious PyPI package targets Chimera users to steal AWS tokens, CI/CD secrets

“Chimera-sandbox-extensions” exploit highlights rising risks of open-source package abuse, prompting calls for stricter dependency controls and DGA malware detection.

By Shweta Sharma

Jun 17, 2025 4 mins

Engineer Malware Security

‘Grafana Ghost’ XSS flaw exposes 47,000 servers to account takeover

The vulnerability enables attackers to load malicious plugins, hijack sessions, and create administrative accounts on unpatched systems.

By Shweta Sharma

Jun 16, 2025 3 mins

Engineer Security Vulnerabilities

Hackers booby trap NPM with cross-language imposter packages

Developers adept at multiple coding languages are tricked into installing a familiar-sounding package from within the Node Package Manager registry instead of the original source.

By Shweta Sharma

May 7, 2025 3 mins

Cyberattacks Engineer Security

Cybercriminals intensify hunt for exposed Git secrets

About 4,800 unique IP addresses were scanned for exposed Git configuration files in a single day to steal sensitive secrets and tokens.

By Shweta Sharma

Apr 30, 2025 3 mins

Engineer Security

Warning to developers: Stay away from these 10 VSCode extensions

Malicious extensions that install a cryptominer were released just as the weekend started.

By Howard Solomon

Apr 7, 2025 4 mins

Engineer Malware Vulnerabilities

GitHub suffers a cascading supply chain attack compromising CI/CD secrets

The CISA has confirmed that the cascading attack from reviewdog to tj-actions exposed sensitive credentials across 23,000+ repositories.

By Gyana Swain

Mar 19, 2025 1 min

Data Breach Engineer Security

North Korean cyberspies trick developers into installing malware with fake job interviews

Once accepted, the attackers tell developers to download a Node.js project as part of a practical test. The trojanized project on launch deploys a RAT and infostealer malware targeting all major OS platforms.

By Lucian Constantin

Jul 31, 2024 6 mins

Cyberattacks Engineer

Report: PowerShell Gallery susceptible to typosquatting and other package-management attacks

Aqua Security says PowerShell issue can allow attacks involving registration of malicious packages with names similar to existing popular package names when developers make mistakes.

By Lucian Constantin

Aug 16, 2023 9 mins

Cyberattacks Engineer Supply Chain

Lessons learned through 15 years of SDL at work

In short? Security Development Lifecycle is all about the developers...

By Steve Lipner

Sep 20, 2019 5 mins

Application Security Engineer Microsoft

4 reasons why CISOs must think like developers to build cybersecurity platforms and stop investing in ‘silver bullets’

The Chief Information Security Officer is the latest addition to the C-suite with funding, staff and authority to ensure the confidentiality, integrity and availability of corporate digital assets. The CISO must quickly shed the tool-centric mindset

By Gaurav Pal

Jul 2, 2018 4 mins

APIs Data and Information Security Technology Industry