PolinRider malware attributed to DPRK's Lazarus group was detected in two open pull requests (#7716, #10321) targeting PostCSS and Tailwind configuration files. The malware uses obfuscated JavaScript code appended to legitimate config content and executes via eval with C2 communication over Ethereum JSON-RPC endpoints. Both PRs should not be merged without removing the malicious payload.
A malicious npm campaign distributing the 'indexed-btree' package and nine related libraries bypasses GitHub's 2026 supply chain defenses by hiding malware in runtime code execution rather than installation scripts. The malware collects system information and uses Ethereum smart contracts for command-and-control, with the campaign achieving millions of downloads across affected packages.
I-server is a networking project that hides a server's identity from clients by using ICMP Echo Reflection and ICMP Destination Unreachable packets to relay communications indirectly through third-party servers, making it difficult to identify the actual server IP from network traffic analysis alone.
A custom 32-bit CPU encrypted at gate-level with anti-tamper and anti-debug protections went unsolved for a year by humans and multiple LLMs, until GPT-6 solved it in 20-30 minutes using side-channel cryptanalysis to exploit weak encryption protecting the CPU state. The challenge featured a virtual architecture with 16 general-purpose registers, bit-addressable memory, and obfuscated VHDL synthesis.
A developer reverse-engineered a challenge-code format in a country guessing game using GPT-6 Astra, discovering that the tokens contained country ISO codes (like 'kr' for South Korea, 'de' for Germany) obfuscated through XOR operations with random bytes, along with a SHA-256 checksum for validation. The analysis demonstrates that security through obfuscation alone is insufficient, as AI can deduce encoded patterns from multiple examples without access to source code.
A demonstration of ELF relocation as a weird machine that executes code without traditional code sections. By exploiting R_X86_64_RELATIVE relocations in non-PIE binaries, the dynamic linker writes shellcode and data to memory before main executes, achieving computation purely through metadata manipulation.
Bashka is a static analyzer for bash install scripts that validates safety before execution using the curl | bash pattern. It scores scripts against multiple checks, follows forwarded scripts, and categorizes findings from critically malicious to advisory levels, while maintaining a lockfile of installed packages for management and removal.
Researchers tested whether LLM-assisted reverse engineering defeats code obfuscation by deploying an autonomous AI agent against progressively hardened AArch64 binaries over an 80-minute window. The agent achieved mixed results, prompting investigation into which protection mechanisms actually resist automated analysis beyond traditional obfuscation.