Indie platform itch.io has posted new guidelines for adult content, in light of last week's deindexing

A subsidiary of Cantor Fitzgerald, which is run by the sons of US commerce secretary Howard Lutnick, is letting clients essentially bet that President Donald Trump’s tariffs will be struck down in court.

Vous cherchez de vrais porno comics japonais, en version physique, sans tomber sur un site […] Cet article Test de JList.com : ce site hentai ne ressemble à aucun autre (et c’est tant mieux) - juillet 2025 a été publié sur REALITE-VIRTUELLE.COM

You never forget your first love.

ActuGaming.net Où trouver du sable farine sur Arrakis ? | Dune Awakening Dune Awakening est un MMORPG axé sur la survie prenant place sur Arrakis, une planète […] L'article Où trouver du sable farine sur Arrakis ? | Dune Awakening est disponib

Autodesk bouleverse le monde de l’animation avec le lancement de MotionMaker, un nouvel outil intégré à Autodesk Maya, alimenté par l’intelligence artificielle, qui promet de révolutionner la manière dont les animateurs vont animer leurs personnages.

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works. Microsoft 365 security in the spotlight after Washington Post hack Paul Hill Neowin @ziks_99 · Jun 16, 2025 03:36 EDT The Washington Post has come under cyberattack which saw Microsoft email accounts of several journalists get compromised. The attack, which was discovered last Thursday, is believed to have been conducted by a foreign government due to the topics the journalists cover, including national security, economic policy, and China. Following the hack, the passwords on the affected accounts were reset to prevent access. The fact that a Microsoft work email account was potentially hacked strongly suggests The Washington Post utilizes Microsoft 365, which makes us question the security of Microsoft’s widely used enterprise services. Given that Microsoft 365 is very popular, it is a hot target for attackers. Microsoft's enterprise security offerings and challenges As the investigation into the cyberattack is still ongoing, just how attackers gained access to the accounts of the journalists is unknown, however, Microsoft 365 does have multiple layers of protection that ought to keep journalists safe. One of the security tools is Microsoft Defender for Office 365. If the hackers tried to gain access with malicious links, Defender provides protection against any malicious attachments, links, or email-based phishing attempts with the Advanced Threat Protection feature. Defender also helps to protect against malware that could be used to target journalists at The Washington Post. Another security measure in place is Entra ID which helps enterprises defend against identity-based attacks. Some key features of Entra ID include multi-factor authentication which protects accounts even if a password is compromised, and there are granular access policies that help to limit logins from outside certain locations, unknown devices, or limit which apps can be used. While Microsoft does offer plenty of security technologies with M365, hacks can still take place due to misconfiguration, user-error, or through the exploitation of zero-day vulnerabilities. Essentially, it requires efforts from both Microsoft and the customer to maintain security. Lessons for organizations using Microsoft 365 The incident over at The Washington Post serves as a stark reminder that all organizations, not just news organizations, should audit and strengthen their security setups. Some of the most important security measures you can put in place include mandatory multi-factor authentication (MFA) for all users, especially for privileged accounts; strong password rules such as using letters, numbers, and symbols; regular security awareness training; and installing any security updates in a timely manner. Many of the cyberattacks that we learn about from companies like Microsoft involve hackers taking advantage of the human in the equation, such as being tricked into sharing passwords or sharing sensitive information due to trickery on behalf of the hackers. This highlights that employee training is crucial in protecting systems and that Microsoft’s technologies, as advanced as they are, can’t mitigate all attacks 100 percent of the time. Tags Report a problem with article Follow @NeowinFeed

show some love for the losers Delightfully irreverent Underdogs isn’t your parents’ nature docuseries Ryan Reynolds narrates NatGeo's new series highlighting nature's much less cool and majestic creatures Jennifer Ouellette – Jun 15, 2025 3:11 pm | 5 The indestructible honey badger is just one of nature's "benchwarmers" featured in Underdogs Credit: National Geographic/Doug Parker The indestructible honey badger is just one of nature's "benchwarmers" featured in Underdogs Credit: National Geographic/Doug Parker Story text Size Small Standard Large Width * Standard Wide Links Standard Orange * Subscribers only   Learn more Narrator Ryan Reynolds celebrates nature's outcasts in the new NatGeo docuseries Underdogs. Most of us have seen a nature documentary or two (or three) at some point in our lives, so it's a familiar format: sweeping majestic footage of impressively regal animals accompanied by reverently high-toned narration (preferably with a tony British accent). Underdogs, a new docuseries from National Geographic, takes a decidedly different and unconventional approach. Narrated by with hilarious irreverence by Ryan Reynolds, the five-part series highlights nature's less cool and majestic creatures: the outcasts and benchwarmers, more noteworthy for their "unconventional hygiene choices" and "unsavory courtship rituals." It's like The Suicide Squad or Thunderbolts*, except these creatures actually exist. Per the official premise, "Underdogs features a range of never-before-filmed scenes, including the first time a film crew has ever entered a special cave in New Zealand—a huge cavern that glows brighter than a bachelor pad under a black light thanks to the glowing butts of millions of mucus-coated grubs. All over the world, overlooked superstars like this are out there 24/7, giving it maximum effort and keeping the natural world in working order for all those showboating polar bears, sharks and gorillas." It's rated PG-13 thanks to the odd bit of scatalogical humor and shots of Nature Sexy Time Each of the five episodes is built around a specific genre. "Superheroes" highlights the surprising superpowers of the honey badger, pistol shrimp, and the invisible glass frog, among others, augmented with comic book graphics; "Sexy Beasts" focuses on bizarre mating habits and follows the format of a romantic advice column; "Terrible Parents" highlights nature's worst practices, following the outline of a parenting guide; "Total Grossout" is exactly what it sounds like; and "The Unusual Suspects" is a heist tale, documenting the supposed efforts of a macaque to put together the ultimate team of masters of deception and disguise (an inside man, a decoy, a fall guy, etc.).  Green Day even wrote and recorded a special theme song for the opening credits. Co-creators Mark Linfield and Vanessa Berlowitz of Wildstar Films are longtime producers of award-winning wildlife films, most notably Frozen Planet, Planet Earth and David Attenborough's Life of Mammals—you know, the kind of prestige nature documentaries that have become a mainstay for National Geographic and the BBC, among others. They're justly proud of that work, but this time around the duo wanted to try something different. Madagascar's aye-aye: "as if fear and panic had a baby and rolled it in dog hair" National Geographic/Eleanor Paish Madagascar's aye-aye: "as if fear and panic had a baby and rolled it in dog hair" National Geographic/Eleanor Paish An emerald jewel wasp emerges from a cockroach. National Geographic/Simon De Glanville An emerald jewel wasp emerges from a cockroach. National Geographic/Simon De Glanville A pack of African hunting dogs is no match for the honey badger's thick hide. National Geographic/Tom Walker A pack of African hunting dogs is no match for the honey badger's thick hide. National Geographic/Tom Walker An emerald jewel wasp emerges from a cockroach. National Geographic/Simon De Glanville A pack of African hunting dogs is no match for the honey badger's thick hide. National Geographic/Tom Walker A fireworm is hit by a cavitation bubble shot from the claw of a pistol shrimp defending its home. National Geographic/Hugh Miller As it grows and molts, the mad hatterpillar stacks old head casings on top of its head. Scientists think it is used as a decoy against would-be predators and parasites, and when needed, it can also be used as a weapon. National Geographic/Katherine Hannaford Worst parents ever? A young barnacle goose chick prepares t make the 800-foot jump from its nest to the ground. National Geographic An adult pearlfish reverses into a sea cucumber's butt to hide. National Geographic A vulture sticks its head inside an elephant carcass to eat. National Geographic A manatee releases flatulence while swimming to lose the buoyancy build up of gas inside its stomach, and descend down the water column. National Geographic/Karl Davies "There is a sense after awhile that you're playing the same animals to the same people, and the shows are starting to look the same and so is your audience," Linfield told Ars. "We thought, okay, how can we do something absolutely the opposite? We've gone through our careers collecting stories of these weird and crazy creatures that don't end up in the script because they're not big or sexy and they live under a rock. But they often have the best life histories and the craziest superpowers." Case in point: the velvet worm featured in the "Superheroes" episode, which creeps up on unsuspecting prey before squirting disgusting slime all over their food. (It's a handy defense mechanism, too, against predators like the wolf spider.) Once Linfield and Berlowitz decided to focus on nature's underdogs and to take a more humorous approach, Ryan Reynolds became their top choice for a narrator—the anti-Richard Attenborough. As luck would have it, the pair shared an agent with the mega-star. So even though they thought there was no way Reynolds would agree to the project, they put together a sizzle reel, complete with a "fake Canadian Ryan Reynolds sound-alike" doing the narration. Reynolds was on set when he received the reel, and loved it so much he recoded his own narration for the footage and sent it back. "From that moment he was in," said Linfield, and Wildstar Films worked closely with Reynolds and his company to develop the final series. "We've never worked that way on a series before, a joint collaboration from day one," Berlowitz admitted. But it worked: the end result strikes the perfect balance between scientific revelation and accurate natural history, and an edgy comic tone. That tone is quintessential Reynolds, and while he did mostly follow the script (which his team helped write), Linfield and Berlowitz admit there was also a fair amount of improvisation—not all of it PG-13.  "What we hadn't appreciated is that he's an incredible improv performer," said Berlowitz. "He can't help himself. He gets into character and starts riffing off [the footage]. There are some takes that we definitely couldn't use, that potentially would fit a slightly more Hulu audience."  Some of the ad-libs made it into the final episodes, however—like Reynolds describing an Aye-Aye as "if fear and panic had a baby and rolled it in dog hair"—even though it meant going back and doing a bit of recutting to get the new lines to fit. Cinematographer Tom Beldam films a long-tailed macaque who stole his smart phone minutes later. National Geographic/Laura Pennafort Cinematographer Tom Beldam films a long-tailed macaque who stole his smart phone minutes later. National Geographic/Laura Pennafort The macaque agrees to trade ithe stolen phone for a piece of food. National Geographic The macaque agrees to trade ithe stolen phone for a piece of food. National Geographic A family of tortoise beetles defend themselves from a carnivorous ant by wafting baby poop in its direction. National Geographic A family of tortoise beetles defend themselves from a carnivorous ant by wafting baby poop in its direction. National Geographic The macaque agrees to trade ithe stolen phone for a piece of food. National Geographic A family of tortoise beetles defend themselves from a carnivorous ant by wafting baby poop in its direction. National Geographic A male hippo sprays his feces at another male who is threatening to take over his patch. National Geographic A male proboscis monkey flaunts his large nose. The noses of these males are used to amplify their calls in the vast forest. National Geographic Dream girl: A blood-soaked female hyena looks across the African savanna. National Geographic A male bowerbird presents one of the finest items in his collection to a female in his bower. National Geographic The male nursery web spider presents his nuptial gift to the female. National Geographic Cue the Barry White mood music: Two leopard slugs suspend themselves on a rope of mucus as they entwine their bodies to mate with one another. National Geographic Despite their years of collective experience, Linfield and Berlowitz were initially skeptical when the crew told them about the pearl fish, which hides from predators in a sea cucumber's butt (along with many other species). "It had never been filmed so we said, 'You're going to have to prove it to us,'" said Berlowitz. "They came back with this fantastic, hilarious sequence of a pearl fish reverse parking [in a sea cucumber's anus)." The film crew experienced a few heart-pounding moments, most notably while filming the cliffside nests of barnacle geese for the "Terrible Parents" episode. A melting glacier caused a watery avalanche while the crew was filming the geese, and they had to quickly grab a few shots and run to safety. Less dramatic: cinematographer Tom Beldam had his smartphone stolen by a long-tailed macaque mere minutes after he finished capturing the animal on film. If all goes well and Underdogs finds its target audience, we may even get a follow-up. "We are slightly plowing new territory but the science is as true as it's ever been and the stories are good. That aspect of the natural history is still there," said Linfield. "I think what we really hope for is that people who don't normally watch natural history will watch it. If people have as much fun watching it as we had making it, then the metrics should be good enough for another season." Verdict: Underdogs is positively addictive; I binged all five episodes in a single day. (For his part, Reynolds said in a statement that he was thrilled to "finally watch a project of ours with my children. Technically they saw Deadpool and Wolverine but I don't think they absorbed much while covering their eyes and ears and screaming for two hours.") Underdogs premieres June 15, 2025, at 9 PM/8 PM Central on National Geographic (simulcast on ABC) and will be available for streaming on Disney+ and Hulu the following day.  You should watch it, if only to get that second season. Jennifer Ouellette Senior Writer Jennifer Ouellette Senior Writer Jennifer is a senior writer at Ars Technica with a particular focus on where science meets culture, covering everything from physics and related interdisciplinary topics to her favorite films and TV series. Jennifer lives in Baltimore with her spouse, physicist Sean M. Carroll, and their two cats, Ariel and Caliban. 5 Comments

There has been a new update to the ongoing Stratasys v. Bambu Lab patent infringement lawsuit.  Both parties have agreed to consolidate the lead and member cases (2:24-CV-00644-JRG and 2:24-CV-00645-JRG) into a single case under Case No. 2:25-cv-00465-JRG.  Industrial 3D printing OEM Stratasys filed the request late last month. According to an official court document, Shenzhen-based Bambu Lab did not oppose the motion. Stratasys argued that this non-opposition amounted to the defendants waiving their right to challenge the request under U.S. patent law 35 U.S.C. § 299(a). On June 2, the U.S. District Court for the Eastern District of Texas, Marshall Division, ordered Bambu Lab to confirm in writing whether it agreed to the proposed case consolidation. The court took this step out of an “abundance of caution” to ensure both parties consented to the procedure before moving forward. Bambu Lab submitted its response on June 12, agreeing to the consolidation. The company, along with co-defendants Shenzhen Tuozhu Technology Co., Ltd., Shanghai Lunkuo Technology Co., Ltd., and Tuozhu Technology Limited, waived its rights under 35 U.S.C. § 299(a). The court will now decide whether to merge the cases. This followed U.S. District Judge Rodney Gilstrap’s decision last month to deny Bambu Lab’s motion to dismiss the lawsuits.  The Chinese desktop 3D printer manufacturer filed the motion in February 2025, arguing the cases were invalid because its US-based subsidiary, Bambu Lab USA, was not named in the original litigation. However, it agreed that the lawsuit could continue in the Austin division of the Western District of Texas, where a parallel case was filed last year.  Judge Gilstrap denied the motion, ruling that the cases properly target the named defendants. He concluded that Bambu Lab USA isn’t essential to the dispute, and that any misnaming should be addressed in summary judgment, not dismissal.        A Stratasys Fortus 450mc (left) and a Bambu Lab X1C (right). Image by 3D Printing industry. Another twist in the Stratasys v. Bambu Lab lawsuit  Stratasys filed the two lawsuits against Bambu Lab in the Eastern District of Texas, Marshall Division, in August 2024. The company claims that Bambu Lab’s X1C, X1E, P1S, P1P, A1, and A1 mini 3D printers violate ten of its patents. These patents cover common 3D printing features, including purge towers, heated build plates, tool head force detection, and networking capabilities. Stratasys has requested a jury trial. It is seeking a ruling that Bambu Lab infringed its patents, along with financial damages and an injunction to stop Bambu from selling the allegedly infringing 3D printers. Last October, Stratasys dropped charges against two of the originally named defendants in the dispute. Court documents showed that Beijing Tiertime Technology Co., Ltd. and Beijing Yinhua Laser Rapid Prototyping and Mould Technology Co., Ltd were removed. Both defendants represent the company Tiertime, China’s first 3D printer manufacturer. The District Court accepted the dismissal, with all claims dropped without prejudice. It’s unclear why Stratasys named Beijing-based Tiertime as a defendant in the first place, given the lack of an obvious connection to Bambu Lab.  Tiertime and Stratasys have a history of legal disputes over patent issues. In 2013, Stratasys sued Afinia, Tiertime’s U.S. distributor and partner, for patent infringement. Afinia responded by suing uCRobotics, the Chinese distributor of MakerBot 3D printers, also alleging patent violations. Stratasys acquired MakerBot in June 2013. The company later merged with Ultimaker in 2022. In February 2025, Bambu Lab filed a motion to dismiss the original lawsuits. The company argued that Stratasys’ claims, focused on the sale, importation, and distribution of 3D printers in the United States, do not apply to the Shenzhen-based parent company. Bambu Lab contended that the allegations concern its American subsidiary, Bambu Lab USA, which was not named in the complaint filed in the Eastern District of Texas. Bambu Lab filed a motion to dismiss, claiming the case is invalid under Federal Rule of Civil Procedure 19. It argued that any party considered a “primary participant” in the allegations must be included as a defendant.    The court denied the motion on May 29, 2025. In the ruling, Judge Gilstrap explained that Stratasys’ allegations focus on the actions of the named defendants, not Bambu Lab USA. As a result, the official court document called Bambu Lab’s argument “unavailing.” Additionally, the Judge stated that, since Bambu Lab USA and Bambu Lab are both owned by Shenzhen Tuozhu, “the interest of these two entities align,” meaning the original cases are valid.   In the official court document, Judge Gilstrap emphasized that Stratasys can win or lose the lawsuits based solely on the actions of the current defendants, regardless of Bambu Lab USA’s involvement. He added that any potential risk to Bambu Lab USA’s business is too vague or hypothetical to justify making it a required party. Finally, the court noted that even if Stratasys named the wrong defendant, this does not justify dismissal under Rule 12(b)(7). Instead, the judge stated it would be more appropriate for the defendants to raise that argument in a motion for summary judgment. The Bambu Lab X1C 3D printer. Image via Bambu Lab. 3D printing patent battles  The 3D printing industry has seen its fair share of patent infringement disputes over recent months. In May 2025, 3D printer hotend developer Slice Engineering reached an agreement with Creality over a patent non-infringement lawsuit.  The Chinese 3D printer OEM filed the lawsuit in July 2024 in the U.S. District Court for the Northern District of Florida, Gainesville Division. The company claimed that Slice Engineering had falsely accused it of infringing two hotend patents, U.S. Patent Nos. 10,875,244 and 11,660,810. These cover mechanical and thermal features of Slice’s Mosquito 3D printer hotend. Creality requested a jury trial and sought a ruling confirming it had not infringed either patent. Court documents show that Slice Engineering filed a countersuit in December 2024. The Gainesville-based company maintained that Creaility “has infringed and continues to infringe” on both patents. In the filing, the company also denied allegations that it had harassed Creality’s partners, distributors, and customers, and claimed that Creality had refused to negotiate a resolution.   The Creality v. Slice Engineering lawsuit has since been dropped following a mutual resolution. Court documents show that both parties have permanently dismissed all claims and counterclaims, agreeing to cover their own legal fees and costs.  In other news, large-format resin 3D printer manufacturer Intrepid Automation sued 3D Systems over alleged patent infringement. The lawsuit, filed in February 2025, accused 3D Systems of using patented technology in its PSLA 270 industrial resin 3D printer. The filing called the PSLA 270 a “blatant knock off” of Intrepid’s DLP multi-projection “Range” 3D printer.   San Diego-based Intrepid Automation called this alleged infringement the “latest chapter of 3DS’s brazen, anticompetitive scheme to drive a smaller competitor with more advanced technology out of the marketplace.” The lawsuit also accused 3D Systems of corporate espionage, claiming one of its employees stole confidential trade secrets that were later used to develop the PSLA 270 printer. 3D Systems denied the allegations and filed a motion to dismiss the case. The company called the lawsuit “a desperate attempt” by Intrepid to distract from its own alleged theft of 3D Systems’ trade secrets. Who won the 2024 3D Printing Industry Awards? Subscribe to the 3D Printing Industry newsletter to keep up with the latest 3D printing news.You can also follow us on LinkedIn, and subscribe to the 3D Printing Industry Youtube channel to access more exclusive content.Featured image shows a Stratasys Fortus 450mc (left) and a Bambu Lab X1C (right). Image by 3D Printing industry.

Jun 16, 2025Ravie LakshmananMalware / DevOps Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that's capable of harvesting sensitive developer-related information, such as credentials, configuration data, and environment variables, among others. The package, named chimera-sandbox-extensions, attracted 143 downloads and likely targets users of a service called Chimera Sandbox, which was released by Singaporean tech company Grab last August to facilitate "experimentation and development of [machine learning] solutions." The package masquerades as a helper module for Chimera Sandbox, but "aims to steal credentials and other sensitive information such as Jamf configuration, CI/CD environment variables, AWS tokens, and more," JFrog security researcher Guy Korolevski said in a report published last week. Once installed, it attempts to connect to an external domain whose domain name is generated using a domain generation algorithm (DGA) in order to download and execute a next-stage payload. Specifically, the malware acquires from the domain an authentication token, which is then used to send a request to the same domain and retrieve the Python-based information stealer. The stealer malware is equipped to siphon a wide range of data from infected machines. This includes - JAMF receipts, which are records of software packages installed by Jamf Pro on managed computers Pod sandbox environment authentication tokens and git information CI/CD information from environment variables Zscaler host configuration Amazon Web Services account information and tokens Public IP address General platform, user, and host information The kind of data gathered by the malware shows that it's mainly geared towards corporate and cloud infrastructure. In addition, the extraction of JAMF receipts indicates that it's also capable of targeting Apple macOS systems. The collected information is sent via a POST request back to the same domain, after which the server assesses if the machine is a worthy target for further exploitation. However, JFrog said it was unable to obtain the payload at the time of analysis. "The targeted approach employed by this malware, along with the complexity of its multi-stage targeted payload, distinguishes it from the more generic open-source malware threats we have encountered thus far, highlighting the advancements that malicious packages have made recently," Jonathan Sar Shalom, director of threat research at JFrog Security Research team, said. "This new sophistication of malware underscores why development teams remain vigilant with updates—alongside proactive security research – to defend against emerging threats and maintain software integrity." The disclosure comes as SafeDep and Veracode detailed a number of malware-laced npm packages that are designed to execute remote code and download additional payloads. The packages in question are listed below - eslint-config-airbnb-compat (676 Downloads) ts-runtime-compat-check (1,588 Downloads) solders (983 Downloads) @mediawave/lib (386 Downloads) All the identified npm packages have since been taken down from npm, but not before they were downloaded hundreds of times from the package registry. SafeDep's analysis of eslint-config-airbnb-compat found that the JavaScript library has ts-runtime-compat-check listed as a dependency, which, in turn, contacts an external server defined in the former package ("proxy.eslint-proxy[.]site") to retrieve and execute a Base64-encoded string. The exact nature of the payload is unknown. "It implements a multi-stage remote code execution attack using a transitive dependency to hide the malicious code," SafeDep researcher Kunal Singh said. Solders, on the other hand, has been found to incorporate a post-install script in its package.json, causing the malicious code to be automatically executed as soon as the package is installed. "At first glance, it's hard to believe that this is actually valid JavaScript," the Veracode Threat Research team said. "It looks like a seemingly random collection of Japanese symbols. It turns out that this particular obfuscation scheme uses the Unicode characters as variable names and a sophisticated chain of dynamic code generation to work." Decoding the script reveals an extra layer of obfuscation, unpacking which reveals its main function: Check if the compromised machine is Windows, and if so, run a PowerShell command to retrieve a next-stage payload from a remote server ("firewall[.]tel"). This second-stage PowerShell script, also obscured, is designed to fetch a Windows batch script from another domain ("cdn.audiowave[.]org") and configures a Windows Defender Antivirus exclusion list to avoid detection. The batch script then paves the way for the execution of a .NET DLL that reaches out to a PNG image hosted on ImgBB ("i.ibb[.]co"). "[The DLL] is grabbing the last two pixels from this image and then looping through some data contained elsewhere in it," Veracode said. "It ultimately builds up in memory YET ANOTHER .NET DLL." Furthermore, the DLL is equipped to create task scheduler entries and features the ability to bypass user account control (UAC) using a combination of FodHelper.exe and programmatic identifiers (ProgIDs) to evade defenses and avoid triggering any security alerts to the user. The newly-downloaded DLL is Pulsar RAT, a "free, open-source Remote Administration Tool for Windows" and a variant of the Quasar RAT. "From a wall of Japanese characters to a RAT hidden within the pixels of a PNG file, the attacker went to extraordinary lengths to conceal their payload, nesting it a dozen layers deep to evade detection," Veracode said. "While the attacker's ultimate objective for deploying the Pulsar RAT remains unclear, the sheer complexity of this delivery mechanism is a powerful indicator of malicious intent." Crypto Malware in the Open-Source Supply Chain The findings also coincide with a report from Socket that identified credential stealers, cryptocurrency drainers, cryptojackers, and clippers as the main types of threats targeting the cryptocurrency and blockchain development ecosystem. Some of the examples of these packages include - express-dompurify and pumptoolforvolumeandcomment, which are capable of harvesting browser credentials and cryptocurrency wallet keys bs58js, which drains a victim's wallet and uses multi-hop transfers to obscure theft and frustrate forensic tracing. lsjglsjdv, asyncaiosignal, and raydium-sdk-liquidity-init, which functions as a clipper to monitor the system clipboard for cryptocurrency wallet strings and replace them with threat actor‑controlled addresses to reroute transactions to the attackers "As Web3 development converges with mainstream software engineering, the attack surface for blockchain-focused projects is expanding in both scale and complexity," Socket security researcher Kirill Boychenko said. "Financially motivated threat actors and state-sponsored groups are rapidly evolving their tactics to exploit systemic weaknesses in the software supply chain. These campaigns are iterative, persistent, and increasingly tailored to high-value targets." AI and Slopsquatting The rise of artificial intelligence (AI)-assisted coding, also called vibe coding, has unleashed another novel threat in the form of slopsquatting, where large language models (LLMs) can hallucinate non-existent but plausible package names that bad actors can weaponize to conduct supply chain attacks. Trend Micro, in a report last week, said it observed an unnamed advanced agent "confidently" cooking up a phantom Python package named starlette-reverse-proxy, only for the build process to crash with the error "module not found." However, should an adversary upload a package with the same name on the repository, it can have serious security consequences. Furthermore, the cybersecurity company noted that advanced coding agents and workflows such as Claude Code CLI, OpenAI Codex CLI, and Cursor AI with Model Context Protocol (MCP)-backed validation can help reduce, but not completely eliminate, the risk of slopsquatting. "When agents hallucinate dependencies or install unverified packages, they create an opportunity for slopsquatting attacks, in which malicious actors pre-register those same hallucinated names on public registries," security researcher Sean Park said. "While reasoning-enhanced agents can reduce the rate of phantom suggestions by approximately half, they do not eliminate them entirely. Even the vibe-coding workflow augmented with live MCP validations achieves the lowest rates of slip-through, but still misses edge cases." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    