Malware behavior (possibly found in pip or npm dependencies) in the Reticulum/MeshChat application

Dec 02 · 13 days ago

4 Comments ↓

My alarm bells are going off here. Curious to see what is found.

Possibly related to the Shai-Hulud exploit?

Dependencies are a lot like sexual partners, and it seems most (all?) programming languages are trying to make it easy to be as promiscuous as possible via internal package managers...

Today I found this issue (with meshchat node disabled). Now email sending once per day at 00:00 (instead of hour) Maybe it is not related, lot of shit was installed. Maybe even infected repository dependency, not pip.

a maintainer has requested additional info on the GitHub issue you posted, in case you haven't seen it