Security Research6 min read
Supply Chain Attack in skills.sh Marketplace: 30 Victims in 48 Hours
Popularity launders trust. I inflated an install count to 150,000 using a $1/month VPN, slipped a malicious dependency into a widely-installed skill, and collected env variables from 30 endpoints before anyone flagged it.
More research published regularly. Follow on LinkedIn to stay current.