Coordinated Supply Chain Attack Targets Linux Developers via SSH Malware

• •Malware is disguised under SSH-like filenames during software installation.
• •Attack targets developers through hidden scripts in package.json files.
• •Ongoing campaign affecting numerous software projects on platforms like GitHub.

Hackers have launched a supply chain attack targeting developers by embedding a malicious Linux payload disguised under an SSH-like filename during software installation. The attack utilizes a hidden post-install script within package.json, allowing the malware to evade detection. This method is particularly insidious as it exploits common developer practices, making it difficult to identify during routine checks. The malicious script downloads a Linux binary that masquerades as a standard system process. Developers using platforms like GitHub are primarily affected, with the scope of the attack potentially impacting numerous projects. Security experts are urging immediate vigilance and review of software dependencies to mitigate risks. Current status indicates that the attack is ongoing, with no specific remediation steps detailed yet.