PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Supply chain attacks: a new era

osec.io | blog | #supply-chain | #web3 | #npm | #javascript | #sandbox | #lavamoat
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec unpacks Lavamoat's Web3 supply-chain defenses — policy files, NPM anti-hijacking, scuttling — and the sneaky bypasses it reported, showing how hard JS ecosystems are to lock down.
Published
Collected

Related coverage

blog · osec.io
How to survive supply-chain attacks
OtterSec breaks down the NPM supply-chain attack that shipped malware in packages like chalk to steal crypto — intercepting wallet requests — plus defenses such as Lavamoat.
vulnerability · osec.io
MetaMask Snaps: playing in the sand
OtterSec digs into MetaMask Snaps' sandbox — isolated iframe, LavaMoat, SES — and breaks down a property spoofing vulnerability it reported in the Snaps sandboxing layer.
incident · wiz.io
Supply chain attack on lottie-player: everything you need to know
Wiz analyzes the lottie-player supply chain attack: malicious versions 2.0.5–2.0.7 prompted Web3 wallet drains after a maintainer token was compromised, impacting 1inch via CDN-hosted copies.
blog · bughunters.google.com
Beyond Sandbox Domains: Rendering Untrusted Web Content with SafeContentFrame
Rendering untrusted web content is risky. SafeContentFrame, a new TypeScript library, isolates such content to protect against XSS, side-channel attacks, and related threats.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · blog.trailofbits.com
Package managers have an integrity problem
# Package managers have an integrity problem Keegan Ryan October 14, 2026 supply-chain, cryptography, ecosystem-security Page content * Simulating malicious package repositories * HTTPS is...
Back