Build-Pipeline

vulnerabilities 2026-09-27
Two Malicious CPAN Modules Smuggle a Python Backdoor Inside a Fake Certificate File
Crypt::SelfCertificate and IO::Socket::SSL::SelfCertificate, two CPAN distributions for generating self-signed certs, shipped versions that hide obfuscated Python code inside a sample cert.pem and execute it as a remote-fetch loader.
supply-chain malware credential-theft backdoor build-pipeline
vulnerabilities 2026-08-22
Poisoned arrayref, internment, and append-only-vec Crates Pull Build-Time Malware via a proc-macro2 Typosquat
A compromised maintainer account published malicious releases of three popular Rust crates that pull in a typosquatted proc-macro2 lookalike whose build.rs script downloads and runs a platform-specific payload at compile time — with infrastructure overlapping known DPRK supply-chain campaigns.
supply-chain rust typosquatting credential-theft build-pipeline apt

Two Malicious CPAN Modules Smuggle a Python Backdoor Inside a Fake Certificate File