SONATYPE UNCOVERS GLOBAL ESPIONAGE CAMPAIGN IN OPEN SOURCE ECOSYSTEMS

Summary from the TLDR InfoSec newsletter

Sonatype uncovered a global espionage campaign led by North Korea's Lazarus Group that uses malware-laced open source packages on npm and PyPI to infiltrate developer environments. Over 234 malicious packages targeted at least 36,000 victims, aiming to steal secrets and open persistent backdoors across critical digital infrastructure.