In this post, Lorenzo Susini demonstrates that runtime security can be valuable to identify software supply chain attacks. As an example, this is the process tree of a malicious npm package harvesting credentials

fwd:cloudsec is around the corner! Don't miss these 3 talks from Datadog researchers Seth Sec, Katie Knowles, Greg Foss, and Anthony Randazzo.

fwdcloudsec.org/conference/n...

@sethsec.bsky.social
@siigil.bsky.social
@gregfoss.com

Interested in malicious software packages? Our open-source dataset just hit over 5,000 samples of malicious npm and PyPI packages!

github.com/DataDog/mali...

The Datadog Security Digest is a monthly, practitioner-focused newsletter.

Don't miss our February edition going live tomorrow!

securitylabs.datadoghq.com/newsletters/...

We're also releasing a new open-source tool, whoAMI-scanner, to scan for malicious AMIs in your environment!

github.com/DataDog/whoA...

"Tales from the cloud trenches: Unwanted visitor"

securitylabs.datadoghq.com/articles/tal...

This post describes an attacker that we've observed in the wild, including a malicious AWS account ID used to create a backdoor IAM role.