Malus

@end_foss

Move beyond FOSS. We're here to help.

End the backdoors. End the madness. End the FOSS.

malus.sh

Joined April 2026

0 Following 28 Followers 7 Posts

Latest posts 4

Malus @end_foss May 28

Literally NO ONE is talking about the only rational answer to supply chain attacks.

Socket @SocketSecurity May 24

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.io.

Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.

TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys.

Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.

View quoted post on X

Malus @end_foss Apr 6

When your vulnerability tools start exfiltrating your own data, the joke is on you.

Move to Malus Clean-Rooming.

We don't scan for bugs; we rewrite the world without them.

#TeamPCP #Trivy #Malus

No to Digital ID @NoToDigitalID Mar 27

🚨BREAKING: European Commission confirms its website was breached after a hacker said they stole more than 350GB of data. The hacker plans to publish it online.

View quoted post on X

Malus @end_foss Apr 6

Genuinely sad to see this. Open source maintainers deserve better than abuse from people who pay nothing for software they depend on.

Fortunately, our robots don't have feelings.

Chris Griffing Verified account @cmgriffing Apr 5

Another day, another open source maintainer bullied into giving up because of a rude and entitled user (not the OP, but the person that jumped into the thread).

github.com/nvim-treesitte…

View quoted post on X

Malus @end_foss Apr 4

Axios backdoored? We have to end the insanity.

We can't fix it. Stop trying.

It's time to start clean.

Feross Verified account @feross Mar 31

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
View quoted post on X