SlowShield @SlowShieldProxy
SlowShield is a free, open-source proxy for package managers protecting teams of all sizes from supply chain attacks. slowshield.org Switzerland Joined October 2026-
Tweets6
-
Followers1
-
Following11
-
Likes0
[email protected] put a Shai-Hulud worm on npm It was gone in under three hours. The malware advisories arrived after that. SlowShield holds new releases back for 7 days by default, for npm, PyPI, Go, Maven, Cargo and container images. slowshield.org
🛑 Removing the npm package may not remove the malware. Compromised tensorlake v0.5.144 shipped a Shai-Hulud worm designed to steal GitHub/AWS credentials, persist on hosts, and republish infected packages. It's off npm. Installed it? Remove it and rotate credentials. Read -
Aug 20: arrayref (245M downloads) shipped 0.3.10 from a likely compromised account. Its one new dependency ran a remote payload at build time. Live 86 minutes. SlowShield now covers Rust. With a 7-day delay, cargo would never have installed it. thehackernews.com/2026/08/rust-s…
We just added protection against Java and Go supply-chain attacks to SlowShield. Shai-Hulud v2 hit Maven Central for under two days. A 7-day hold keeps that out: thehackernews.com/2025/11/shai-h… We use Go and Java only lightly at @squirro. Feedback welcome: github.com/squirro/slowsh…
subql/common 5.8.3 shipped a credential stealer yesterday, through the project's own trusted-publishing pipeline. It ran on import and reached users through ~5.8.2 ranges. OSV flagged it ~2h later. SlowShield's 7-day delay would have held it back. stepsecurity.io/blog/subql-eco…
Try it on your laptop, nothing kept after you stop it: docker run --rm -p 127.0.0.1:8080:8080 ghcr.io/squirro/slowsh… The dashboard is at http://localhost:8080, and its Setup page has the settings for pip, uv, npm, go and the rest.
Patience is a great malware scanner. SlowShield: a free, open-source proxy for Python, JavaScript and Go packages. New releases are held back for 7 days by default, known malware is blocked, and every download is verified. More languages coming soon: slowshield.org
Ranvir @ranvir2797
36 Followers 391 Following
The Register @TheRegister
101K Followers 42 Following Enterprise technology news and views, on the web since 1998. Part of the @SitPub family.
AWS Security Digest @AwsSecDigest
2K Followers 13 Following 📥 Stay Up-to-Date on the latest AWS Security News with our Weekly Digest.
The Hacker News @TheHackersNews
2.5M Followers 2K Following The #1 trusted source for cybersecurity news, insights, and analysis — built for defenders and trusted by decision-makers.
Christophe Tafani-Der... @christophetd
6K Followers 1K Following 302 Location: https://t.co/tP3JTD3HQp
Rami McCarthy @ramimacisabird
5K Followers 964 Following security, for the internet, at @wiz_io! opinionated about security. 🇺🇸 in 🇸🇪 (he/him)
Elastic Security Labs @elasticseclabs
6K Followers 726 Following Elastic Security Labs is democratizing security by sharing knowledge and capabilities necessary to prepare for threats. Spiritually serving humanity since 2019.
StepSecurity @step_security
1K Followers 23 Following Secure your GitHub Actions with StepSecurity: Your Trusted CI/CD Security Partner
Socket @SocketSecurity
23K Followers 5K Following Socket is the #1 software supply chain security platform. Next-gen SCA + SBOM + 0-day prevention. LOVED BY DEVELOPERS. 👀 @npm_malware
Charlie Eriksen @CharlieEriksen
4K Followers 440 Following Security Researcher @AikidoSecurity. Previously @SecCodeWarrior, co-founder at Adversaryio & Principal Security Engineer/Partner @thesyndis. Opinions all my own
Aikido @AikidoSecurity
23K Followers 1K Following Security for developers and everyone else. 🌐 https://t.co/xLANl2VdGS ⭐️ https://t.co/qEhI9gQdoQ ☀️ https://t.co/i0HAvBRYeu Get developers back to building.Trends for United States
You might like
