ReversingLabs Blog
reversinglabs.com · Company blog · on HN since 2014
ReversingLabs, a security company, publishes research on malware, software supply chain attacks, and malicious packages and extensions.
What HN saysHN links it for reports on malicious Python and NPM packages and fake recruiter tests; commenters also note some reposts of its original reports.
18HN people shared it
7linked it in comments
14stories submitted
253story points
3 months agolast shared
2014people per year2026
Most-shared posts
- 1Fake recruiter coding tests target devs with malicious Python packages2 people · 2 points · first shared 2024 · 1 comments on HN
- 2Malware found on NPM infecting local package with reverse shell1 people · 233 points · first shared 2025 · 140 comments on HN
- 31 in 10 developers leaked an API-key in 20221 people · 3 points · first shared 2023 · discussion on HN
- 4Malicious helpers: VS Code Extensions observed stealing sensitive information1 people · 2 points · first shared 2024 · discussion on HN
- 5OWASP Top for LLM Apps 2026: Excessive agency risk on the rise1 people · 2 points · first shared 2026 · discussion on HN
- 6NVD delays highlight vulnerability management woes: Put malware first1 people · 2 points · first shared 2024 · discussion on HN
- 7Malicious ML models discovered on Hugging Face platform1 people · 2 points · first shared 2025 · discussion on HN
- 8Typosquatting campaign delivers r77 rootkit via NPM1 people · 1 points · first shared 2023 · discussion on HN
- 9GitHub Boosts Secrets Scanning1 people · 1 points · first shared 2023 · discussion on HN
- 10Developers beware: Imposter HTTP libraries lurk on PyPI1 people · 1 points · first shared 2023 · discussion on HN
- 11RoguePuppet software supply chain exposure: Lessons learned1 people · 1 points · first shared 2024 · discussion on HN
- 12The "Graphalgo" NPM/PyPI campaign targeting developers (Lazarus Group)1 people · 1 points · first shared 2026 · discussion on HN
- 13MCP security tracks API's playbook – we know how that ends1 people · 1 points · first shared 2026 · discussion on HN
- 14Gartner's CTEM advances vulnerability management1 people · 1 points · first shared 2025 · discussion on HN
- 15Titanengine1 people · first shared 2014
What HN people wrote when they linked it
_p2zi · 2024-09-15
This is the original report by ReversingLabs: https://www.reversinglabs.com/blog/fake-recruiter-coding-tests-target-…
rwmj · 2024-01-27
userbinator · 2015-02-12
encrypts software code such that it’s only decrypted by the computer’s processor at the last possible moment before the code is executed.
I have heard this phrase repeated so many times in the advertisements for protectors/packers that it's become almost cliche. Such techniques have been around for over 20 years. Using the debug registers to store the decryption key is relatively well-known - and defeatable (this is 5+ years ago):
http://reversinglabs.com/newsroom/blog/lockpicking-telock.html
On the other hand, I like how the article presents the negative aspect too - that security features can be used to make systems secure against their owners is a point that I definitely believe needs to be more prominent among the public.
voltagex_ · 2014-07-27
This is based on the TitanEngine. http://www.reversinglabs.com/resources/open-source/titanengine.html
Is there a word for open source that has no revision history? (there's just a .rar file on that site). 7zip does it too and it drives me crazy.
waterTanuki · 2026-03-31
Because no other language has ever had supply chain attacks ever, in history. Nope.
https://blog.rust-lang.org/2022/05/10/malicious-crate-rustdecimal/
https://en.wikipedia.org/wiki/Log4Shell
https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/
https://about.gitlab.com/blog/gitlab-catches-mongodb-go-module-supply-…
https://www.reversinglabs.com/blog/packagist-php-repo-supply-chain-thr…
jollofricepeas · 2022-12-27
It’s already extremely common in the Python, Ruby and Node ecosystem (see sources below).
The only company that has a real chance at making a dent in the issue is GitHub and to a degree they already have.
SOURCES:
- https://www.mandiant.com/resources/blog/supply-chain-node-js
- https://www.zdnet.com/article/backdoor-found-in-ruby-library-for-check…
- https://www.reversinglabs.com/blog/mining-for-malicious-ruby-gems
- https://news.sophos.com/en-us/2021/10/24/node-poisoning-hijacked-packa…
- https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-c…
- https://portswigger.net/daily-swig/amp/malicious-python-library-ctx-re…
cosmicgadget · 2025-04-25
HiddenLayer's latest research uncovers a universal prompt injection bypass impacting GPT-4, Claude, Gemini, and more, exposing major LLM security gaps. (https://news.ycombinator.com/item?id=43793280)
1. Machine learning adversarial attacks are a ticking time bomb - TechTalks (https://bdtechtalks.com/2020/12/16/machine-learning-adversarial-attack…
2. How ChatGPT actually works (https://www.assemblyai.com/blog/how-chatgpt-actually-works/)
3. PrivacyRaven Has Left the Nest | Trail of Bits Blog (https://blog.trailofbits.com/2020/10/08/privacyraven-has-left-the-nest…
4. Prompt injection: What's the worst that can happen? (https://simonwillison.net/2023/Apr/14/worst-that-can-happen/)
5. The big cybersecurity themes at Black Hat 2024 - and why they matter (https://www.reversinglabs.com/blog/the-big-cybersecurity-themes-at-bla…