CoinList Passage 集成 Superstate 代币化股票
Related
SlowMist: A new family of malware has emerged in the Go module ecosystem, targeting the developer environment of the Cosmos SDK project.
According to Foresight News , blockchain security company SlowMist tweeted that the Mini Shai-Hulud, Miasma, and Hades malware families have expanded from npm to the Go module ecosystem. The affected projects are specific versions based on the Cosmos SDK L1 project verana-labs/verana. The malicious code is hidden in an obfuscated form in the .claude/ directory and uses workflow hooks in VS Code and AI assistants, such as .claude/setup.mjs and .vscode/setup.mjs, to trigger execution when the developer opens the repository. This attack was not a traditional build-time supply chain attack, but rather an attack targeting the developer's local environment. The risk lies in the misuse of IDE automation and AI-assisted tools. Developers are advised to avoid opening untrusted repositories when IDE automation is enabled, and to focus on auditing .claude and .vscode related files, while also rotating potentially compromised credentials.
Equation News founder Vida: Personal AI programming tools cost over $10,000 in the past three months.
According to Foresight News , Vida, the founder of Formula News, published an article titled "Where Did Vida Go?", revealing that he has been deeply involved in AI programming development over the past three months. During this period, his personal account has spent over $10,000 on tokens on OpenAI Codex and Anthropic Claude Code. He has also put his previously conceived projects and game assistance tools into practice and given away multiple Codex subscriptions to relatives and friends in China.
CZ: My official title is that of a serious criminal, but my reputation will change over time.
According to Foresight News , CZ shared a video conversation on X, filmed by photographer Platon. In the video, CZ discussed his 2023 plea of guilty to federal charges in the United States, saying that he cried the morning he learned he would appear in court to plead guilty the following day. "That was probably one of only two times I've cried as an adult; the other was when my father passed away." Regarding his imprisonment experience, he said that prison made him rethink what is truly important in life: "Not money, but health, family, friends, and meaningful social interactions—those are the things you miss most." Regarding receiving a pardon from President Trump, CZ said the pardon changed his title, but it couldn't change the fact that he had made a mistake. "My title is felon, I have a criminal record, which is very serious. But I have a very clear piece of advice: Don't worry about what others think of you, be a good person, give it time, people's opinions of you will change, and your reputation will eventually catch up." Platon is a renowned portrait photographer who has photographed portraits of over 30 world leaders and celebrities. His work has been featured in magazines such as Time and The New Yorker, and he founded The People's Portfolio, a foundation dedicated to human rights records.
The window for the passage of the Clarity Act is narrowing: whether it can pass before Congress's summer recess remains uncertain.
According to Foresight News , citing CoinDesk, the CLARITY Act's original goal of being signed on July 4th has been missed, and the window for its passage before the midterm elections is rapidly closing. While most of the Senate's work can proceed behind the scenes during the summer recess, the House process is currently stalled. Negotiators remain optimistic about passing the bill by 2026, but key coordination needs to be completed before the Senate recess on August 7th. If the bill fails to pass before the midterm elections, and the Democrats gain control of Congress after the elections, they will likely demand significant changes to the bill.
Yooldo: The previous ESPORTS crash was caused by a partner's token sale.
According to Foresight News , Yooldo released an official statement regarding the sharp market price drop on May 25th. The team stated that the previous plunge in ESPORTS was not an intentional or directed sell-off by the project team. Rather, it was due to market manipulation by one of the external OTC and market-making partners that deviated from the agreed-upon terms after the introduction of external OTC and market-making partners to provide liquidity. The statement indicated that preliminary investigations suggest some of the selling pressure may have originated from tokens previously allocated to this partner, but due to the funds passing through multiple wallets and trading platforms, complete tracing remains difficult. Since the incident, the team has been cooperating with exchanges and relevant parties in the investigation and has taken measures such as providing liquidity support and adding new long-term partners to mitigate the market impact. The team also stated that it will launch game updates and a buyback plan and urged projects in the industry to carefully select market-making partners to avoid similar risks in the future. According to a previous report by Foresight News , Ember Monitoring reported that on May 25, the ESPORTS project's associated address sold 253 million ESPORTS tokens, cashing out 17.29 million USDT.
SlowMist: Detected malicious supply chain attack campaign targeting npm users and DeFi developers.
According to Foresight News , SlowMist has detected a coordinated malicious npm supply chain campaign that uses fake trading bot codebases and DeFi-themed npm packages to deliver JavaScript information-stealing tools to npm users, DeFi developers, and trading bot users. This campaign involved 30 malicious npm packages, including stake-math@3.5.4, which was identified as a locked dependency in donoaccestag/forex-mt5-trading-bot. The codebase exhibited clear anomalies: it relied on a malicious npm package that had already been reported for security violations, and contained approximately 2300 highly homogeneous, possibly batch-generated forks, primarily concentrated under the poly-stocks account. Potential attackers may steal sensitive local data such as encrypted wallets, browser cookies, saved passwords, browsing history, developer credentials, shell history, password manager vaults, private keys, seed phrase, and API tokens found in the source code. Developers should immediately remove the affected npm packages, audit the CI logs (e.g., _2024111120230_| / _2024111120231_|) to locate these 30 malicious packages, consider systems that have run `npm install` as potential victims, promptly replace exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild the affected environment from a clean image.