#DirtyBlanket
LightNews LightNews
threadlinqs.bsky.social
Fake yay/paru AUR packages ran a remote script as root at install - check pacman history for yyay now. https://intel.threadlinqs.com/threat/TL-2026-3646 #ThreatIntel #CHAOS #DirtyBlanket #Tor
Fake AUR helper packages (yyay, paru lookalikes) deliver malware via trojanized install scripts with root privileges
October 15, 2026 at 5:27 PM
pixelmagazine.pt
Um utilizador carregou clones maliciosos dos helpers yay e paru para o Arch User Repository. O ataque explora a confiança cega no AUR e liga-se a campanhas anteriores como DirtyBlanket.
Pacotes falsos no AUR instalam malware com permissões de root
Um utilizador carregou clones maliciosos dos helpers yay e paru para o Arch User Repository. O ataque explora a confiança cega no AUR e liga-se a campanhas anteriores como DirtyBlanket.
pixelmagazine.pt
October 16, 2026 at 9:36 AM
thecircuitry.to
Malicious packages mimicking yay and paru reached the Arch User Repository, running remote shell scripts with root privileges after install.
The AUR team banned the account and removed the packages, which share infrastructure with the DirtyBlanket npm worm.
October 15, 2026 at 5:52 PM
baumannzone.dev
😱 9 paquetes npm haciéndose pasar por Express y React colaban un gusano en Linux.

Te metía un RAT por Tor, te robaba las claves SSH y usaba tus tokens npm para infectar a otros.

Escribí un articulo sobre esto:
www.baumannzone.dev/blog/dirtybl...
DirtyBlanket: un gusano de Linux escondido en falsos paquetes de Express
Nueve paquetes de npm que imitan a Express y React instalan una puerta trasera en Linux y se propagan solos por SSH, AUR y npm. Qué ha pasado, cómo funciona y cómo comprobar si te afecta.
www.baumannzone.dev
October 13, 2026 at 11:46 AM
campuscodi.risky.biz
-Half a mil creds still on GitHub
-New Milk Dragon PhaaS
-New DragonForce backdoors
-DirtyBlanket worm hits npm
-UAT-11587 targets SE Asia
-Montenegro extradites Iranian APT member
-New Cisco SD-WAN zero-day
-Zammad zero-days behind DIVD hack
-Zimbra bug exploited in the wild
-BSides Belfast videos
October 2, 2026 at 8:36 AM
lobsters-feed.bsky.social
Fake Express Packages on npm Spread a Linux Worm https://lobste.rs/s/e2gxro ##security ##linux ##nodejs
DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm
Nine fake Express and React packages on npm run a Linux worm at install time. It installs a Tor backdoor and spreads through SSH, AUR packages, and npm tokens.
safedep.io
September 30, 2026 at 4:10 AM
cyberveille-ch.bsky.social
📢 DirtyBlanket : neuf faux packages npm propagent un ver Linux auto-répliquant

Cet article présente une analyse technique détaillée d'une campagne de supply chain nommée DirtyBlanket. Neuf packages npm malveillants ont été publiés le même…

🟡 vérification factuelle moyenne
#npm #AUR #Cyberveille
DirtyBlanket : neuf faux packages npm propagent un ver Linux auto-répliquant
Cet article présente une analyse technique détaillée d'une campagne de supply chain nommée DirtyBlanket. Neuf packages npm malveillants ont été publiés le même jour entre 06:05 et 06:38 UTC par le compte npm dirtyblanket.
cyberveille.ch
September 29, 2026 at 2:30 PM
365tipu.cz
V devíti balíčcích npm se skrývá linuxový červ, který se sám šíří.
DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm
Nine fake Express and React packages on npm run a Linux worm at install time. It installs a Tor backdoor and spreads through SSH, AUR packages, and npm tokens.
safedep.io
September 30, 2026 at 6:27 AM