ActuGaming.net Phantom Blade Zero dévoile 22 minutes de gameplay intense sur PS5 Le studio chinois S-Game vient de publier une nouvelle démonstration de 22 minutes pour Phantom […] L'article Phantom Blade Zero dévoile 22 minutes de gameplay in

Persona 5: The Phantom X’s saga of post-launch controversy continues, as Atlus and Black Wings Game Studio’s response to player backlash has only made some members of the game’s community more angry, as they don’t feel like their concerns are being h

Persona 5: The Phantom X has faced a sudden barrage of criticism in the wake of its western launch. The team at Black Wings Game Studio was met with backlash after it was announced the gacha game would be accelerating its story rollout to catch up to

When it was announced that Persona 5: The Phantom X would be accelerating its story content rollout for the West to catch up to China, which has had the game for over a year, players were wary. As a gacha game with timed events and currency, The Phan

Persona 5: The Phantom X has been out in the West for only a week and a half, but in China, the gacha game has been out for over a year. As a result, most of the world is far behind the Chinese audience on story and character updates. Rather than let

ActuGaming.net Hogwarts Legacy: L’Héritage de Poudlard – Notre avis sur la version Nintendo Switch 2 du jeu le plus vendu de 2023 Sorti en février 2023 et devenu un véritable phénomène cette même année avec plus de […] L'article Ho

Jun 16, 2025Ravie LakshmananMalware / DevOps Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that's capable of harvesting sensitive developer-related information, such as credentials, configuration data, and environment variables, among others. The package, named chimera-sandbox-extensions, attracted 143 downloads and likely targets users of a service called Chimera Sandbox, which was released by Singaporean tech company Grab last August to facilitate "experimentation and development of [machine learning] solutions." The package masquerades as a helper module for Chimera Sandbox, but "aims to steal credentials and other sensitive information such as Jamf configuration, CI/CD environment variables, AWS tokens, and more," JFrog security researcher Guy Korolevski said in a report published last week. Once installed, it attempts to connect to an external domain whose domain name is generated using a domain generation algorithm (DGA) in order to download and execute a next-stage payload. Specifically, the malware acquires from the domain an authentication token, which is then used to send a request to the same domain and retrieve the Python-based information stealer. The stealer malware is equipped to siphon a wide range of data from infected machines. This includes - JAMF receipts, which are records of software packages installed by Jamf Pro on managed computers Pod sandbox environment authentication tokens and git information CI/CD information from environment variables Zscaler host configuration Amazon Web Services account information and tokens Public IP address General platform, user, and host information The kind of data gathered by the malware shows that it's mainly geared towards corporate and cloud infrastructure. In addition, the extraction of JAMF receipts indicates that it's also capable of targeting Apple macOS systems. The collected information is sent via a POST request back to the same domain, after which the server assesses if the machine is a worthy target for further exploitation. However, JFrog said it was unable to obtain the payload at the time of analysis. "The targeted approach employed by this malware, along with the complexity of its multi-stage targeted payload, distinguishes it from the more generic open-source malware threats we have encountered thus far, highlighting the advancements that malicious packages have made recently," Jonathan Sar Shalom, director of threat research at JFrog Security Research team, said. "This new sophistication of malware underscores why development teams remain vigilant with updates—alongside proactive security research – to defend against emerging threats and maintain software integrity." The disclosure comes as SafeDep and Veracode detailed a number of malware-laced npm packages that are designed to execute remote code and download additional payloads. The packages in question are listed below - eslint-config-airbnb-compat (676 Downloads) ts-runtime-compat-check (1,588 Downloads) solders (983 Downloads) @mediawave/lib (386 Downloads) All the identified npm packages have since been taken down from npm, but not before they were downloaded hundreds of times from the package registry. SafeDep's analysis of eslint-config-airbnb-compat found that the JavaScript library has ts-runtime-compat-check listed as a dependency, which, in turn, contacts an external server defined in the former package ("proxy.eslint-proxy[.]site") to retrieve and execute a Base64-encoded string. The exact nature of the payload is unknown. "It implements a multi-stage remote code execution attack using a transitive dependency to hide the malicious code," SafeDep researcher Kunal Singh said. Solders, on the other hand, has been found to incorporate a post-install script in its package.json, causing the malicious code to be automatically executed as soon as the package is installed. "At first glance, it's hard to believe that this is actually valid JavaScript," the Veracode Threat Research team said. "It looks like a seemingly random collection of Japanese symbols. It turns out that this particular obfuscation scheme uses the Unicode characters as variable names and a sophisticated chain of dynamic code generation to work." Decoding the script reveals an extra layer of obfuscation, unpacking which reveals its main function: Check if the compromised machine is Windows, and if so, run a PowerShell command to retrieve a next-stage payload from a remote server ("firewall[.]tel"). This second-stage PowerShell script, also obscured, is designed to fetch a Windows batch script from another domain ("cdn.audiowave[.]org") and configures a Windows Defender Antivirus exclusion list to avoid detection. The batch script then paves the way for the execution of a .NET DLL that reaches out to a PNG image hosted on ImgBB ("i.ibb[.]co"). "[The DLL] is grabbing the last two pixels from this image and then looping through some data contained elsewhere in it," Veracode said. "It ultimately builds up in memory YET ANOTHER .NET DLL." Furthermore, the DLL is equipped to create task scheduler entries and features the ability to bypass user account control (UAC) using a combination of FodHelper.exe and programmatic identifiers (ProgIDs) to evade defenses and avoid triggering any security alerts to the user. The newly-downloaded DLL is Pulsar RAT, a "free, open-source Remote Administration Tool for Windows" and a variant of the Quasar RAT. "From a wall of Japanese characters to a RAT hidden within the pixels of a PNG file, the attacker went to extraordinary lengths to conceal their payload, nesting it a dozen layers deep to evade detection," Veracode said. "While the attacker's ultimate objective for deploying the Pulsar RAT remains unclear, the sheer complexity of this delivery mechanism is a powerful indicator of malicious intent." Crypto Malware in the Open-Source Supply Chain The findings also coincide with a report from Socket that identified credential stealers, cryptocurrency drainers, cryptojackers, and clippers as the main types of threats targeting the cryptocurrency and blockchain development ecosystem. Some of the examples of these packages include - express-dompurify and pumptoolforvolumeandcomment, which are capable of harvesting browser credentials and cryptocurrency wallet keys bs58js, which drains a victim's wallet and uses multi-hop transfers to obscure theft and frustrate forensic tracing. lsjglsjdv, asyncaiosignal, and raydium-sdk-liquidity-init, which functions as a clipper to monitor the system clipboard for cryptocurrency wallet strings and replace them with threat actor‑controlled addresses to reroute transactions to the attackers "As Web3 development converges with mainstream software engineering, the attack surface for blockchain-focused projects is expanding in both scale and complexity," Socket security researcher Kirill Boychenko said. "Financially motivated threat actors and state-sponsored groups are rapidly evolving their tactics to exploit systemic weaknesses in the software supply chain. These campaigns are iterative, persistent, and increasingly tailored to high-value targets." AI and Slopsquatting The rise of artificial intelligence (AI)-assisted coding, also called vibe coding, has unleashed another novel threat in the form of slopsquatting, where large language models (LLMs) can hallucinate non-existent but plausible package names that bad actors can weaponize to conduct supply chain attacks. Trend Micro, in a report last week, said it observed an unnamed advanced agent "confidently" cooking up a phantom Python package named starlette-reverse-proxy, only for the build process to crash with the error "module not found." However, should an adversary upload a package with the same name on the repository, it can have serious security consequences. Furthermore, the cybersecurity company noted that advanced coding agents and workflows such as Claude Code CLI, OpenAI Codex CLI, and Cursor AI with Model Context Protocol (MCP)-backed validation can help reduce, but not completely eliminate, the risk of slopsquatting. "When agents hallucinate dependencies or install unverified packages, they create an opportunity for slopsquatting attacks, in which malicious actors pre-register those same hallucinated names on public registries," security researcher Sean Park said. "While reasoning-enhanced agents can reduce the rate of phantom suggestions by approximately half, they do not eliminate them entirely. Even the vibe-coding workflow augmented with live MCP validations achieves the lowest rates of slip-through, but still misses edge cases." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

Meet Martha Swope, the Legendary Broadway Photographer Who Captured Iconic Moments From Hundreds of Productions and Rehearsals She spent nearly 40 years taking theater and dance pictures, providing glimpses behind the scenes and creating images that the public couldn’t otherwise access Stephanie Rudig - Freelance Writer June 11, 2025 Photographer Martha Swope sitting on a floor covered with prints of her photos in 1987 Andrea Legge / © NYPL Martha Swope wanted to be a dancer. She moved from her home state of Texas to New York to attend the School of American Ballet, hoping to start a career in dance. Swope also happened to be an amateur photographer. So, in 1957, a fellow classmate invited her to bring her camera and document rehearsals for a little theater show he was working on. The classmate was director and choreographer Jerome Robbins, and the show was West Side Story. One of those rehearsal shots ended up in Life magazine, and Swope quickly started getting professional bookings. It’s notoriously tough to make it on Broadway, but through photography, Swope carved out a career capturing theater and dance. Over the course of nearly four decades, she photographed hundreds more rehearsals, productions and promotional studio shots. Unidentified male chorus members dancing during rehearsals for musical West Side Story in 1957 Martha Swope / © NYPL At a time when live performances were not often or easily captured, Swope’s photographs caught the animated moments and distilled the essence of a show into a single image: André De Shields clad in a jumpsuit as the title character in The Wiz, Patti LuPone with her arms raised overhead in Evita, the cast of Cats leaping in feline formations, a close-up of a forlorn Sheryl Lee Ralph in Dreamgirls and the row of dancers obscuring their faces with their headshots in A Chorus Line were all captured by Swope’s camera. She was also the house photographer for the New York City Ballet and the Martha Graham Dance Company and photographed other major dance companies such as the Ailey School. Her vision of the stage became fairly ubiquitous, with Playbill reporting that in the late 1970s, two-thirds of Broadway productions were photographed by Swope, meaning her work dominated theater and dance coverage. Carol Rosegg was early in her photography career when she heard that Swope was looking for an assistant. “I didn't frankly even know who she was,” Rosegg says. “Then the press agent who told me said, ‘Pick up any New York Times and you’ll find out.’” Swope’s background as a dancer likely equipped her to press the shutter at the exact right moment to capture movement, and to know when everyone on stage was precisely posed. She taught herself photography and early on used a Brownie camera, a simple box model made by Kodak. “She was what she described as ‘a dancer with a Brownie,’” says Barbara Stratyner, a historian of the performing arts who curated exhibitions of Swope’s work at the New York Public Library. An ensemble of dancers in rehearsal for the stage production Cats in 1982 Martha Swope / © NYPL “Dance was her first love,” Rosegg says. “She knew everything about dance. She would never use a photo of a dancer whose foot was wrong; the feet had to be perfect.” According to Rosegg, once the photo subjects knew she was shooting, “the anxiety level came down a little bit.” They knew that they’d look good in the resulting photos, and they likely trusted her intuition as a fellow dancer. Swope moved with the bearing of a dancer and often stood with her feet in ballet’s fourth position while she shot. She continued to take dance classes throughout her life, including at the prestigious Martha Graham School. Stratyner says, “As Graham got older, [Swope] was, I think, the only person who was allowed to photograph rehearsals, because Graham didn’t want rehearsals shown.” Photographic technology and the theater and dance landscapes evolved greatly over the course of Swope’s career. Rosegg points out that at the start of her own career, cameras didn’t even automatically advance the film after each shot. She explains the delicate nature of working with film, saying, “When you were shooting film, you actually had to compose, because you had 35 shots and then you had to change your film.” Swope also worked during a period of changing over from all black-and-white photos to a mixture of black-and-white and color photography. Rosegg notes that simultaneously, Swope would shoot black-and-white, and she herself would shoot color. Looking at Swope’s portfolio is also an examination of increasingly crisp photo production. Advances in photography made shooting in the dark or capturing subjects under blinding stage lights easier, and they allowed for better zooming in from afar. Martha Graham rehearses dancer Takako Asakawa and others in Heretic, a dance work choreographed by Graham, in 1986 Martha Swope / © NYPL It’s much more common nowadays to get a look behind the curtain of theater productions via social media. “The theater photographers of today need to supply so much content,” Rosegg says. “We didn’t have any of that, and getting to go backstage was kind of a big deal.” Photographers coming to document a rehearsal once might have been seen as an intrusion, but now, as Rosegg puts it, “everybody is desperate for you to come, and if you’re not there, they’re shooting it on their iPhone.” Even with exclusive behind-the-scenes access to the hottest tickets in town and the biggest stars of the day, Swope remained unpretentious. She lived and worked in a brownstone with her apartment above her studio, where the film was developed in a closet and the bathroom served as a darkroom. Rosegg recalls that a phone sat in the darkroom so they could be reached while printing, and she would be amazed at the big-name producers and theater glitterati who rang in while she was making prints in an unventilated space. From left to right: Paul Winfield, Ruby Dee, Marsha Jackson and Denzel Washington in the stage production Checkmates in 1988 Martha Swope / © NYPL Swope’s approachability extended to how she chose to preserve her work. She originally sold her body of work to Time Life, and, according to Stratyner, she was unhappy with the way the photos became relatively inaccessible. She took back the rights to her collection and donated it to the New York Public Library, where many photos can be accessed by researchers in person, and the entire array of photos is available online to the public in the Digital Collections. Searching “Martha Swope” yields over 50,000 items from more than 800 productions, featuring a huge variety of figures, from a white-suited John Travolta busting a disco move in Saturday Night Fever to Andrew Lloyd Webber with Nancy Reagan at a performance of Phantom of the Opera. Swope’s extensive career was recognized in 2004 with a special Tony Award, a Tony Honors for Excellence in Theater, which are given intermittently to notable figures in theater who operate outside of traditional awards categories. She also received a lifetime achievement award from the League of Professional Theater Women in 2007. Though she retired in 1994 and died in 2017, her work still reverberates through dance and Broadway history today. For decades, she captured the fleeting moments of theater that would otherwise never be seen by the public. And her passion was clear and straightforward. As she once told an interviewer: “I’m not interested in what’s going on on my side of the camera. I’m interested in what’s happening on the other side.” Get the latest Travel & Culture stories in your inbox.

cookielawinfo-checkbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".cookielawinfo-checkbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".cookielawinfo-checkbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.