Brief items

npm debug and chalk packages compromised (Aikido)

The Aikido blog describes an apparently ongoing series of phishing attacks against npm package maintainers, resulting in the uploading of compromised versions of heavily used packages:

All together, these packages have more than 2 billion downloads per week.

The packages were updated to contain a piece of code that would be executed on the client of a website, which silently intercepts crypto and web3 activity in the browser, manipulates wallet interactions, and rewrites payment destinations so that funds and approvals are redirected to attacker-controlled accounts without any obvious signs to the user.

Comments (32 posted)

Security quotes of the week

For anybody confused about how this happens, basically:

• For about the past 15 years every business has been developing apps by pulling in 178 interconnected libraries written by 24 people in a shed in Skegness
• For about the past 2 years orgs have been buying AI vibe coding tools, where some exec screams "make online shop" into a computer and 389 libraries are added and an app is farted out

The output = if you want to own the world's companies, just phish one guy in Skegness

— Kevin Beaumont

This kind of thing should make everybody stop and really think before deploying any AI agents. We simply don't know to defend against these attacks. We have zero agentic AI systems that are secure against these attacks. Any AI that is working in an adversarial environment—and by this I mean that it may encounter untrusted training data or input—is vulnerable to prompt injection. It's an existential problem that, near as I can tell, most people developing these technologies are just pretending isn't there.

— Bruce Schneier

Comments (2 posted)

Kernel release status

The current development kernel is 6.17-rc5, released on September 7. "Things remain normal - both the diffstat and the commit counts look entirely sane". The announcement also contains a plea for maintainers to not overuse Link: tags when applying patches.

Stable updates: 6.16.5, 6.12.45, 6.6.104, 6.1.150, 5.15.191, 5.10.242, and 5.4.298 were released on September 4, followed by 6.16.6, 6.12.46, 6.6.105, 6.1.151, 5.15.192, 5.10.243, and 5.4.299 on September 9.

Comments (none posted)

A path toward removal of kernel high-memory support

As a followup to his OSS Europe talk on the future of 32-bit support in the kernel, Arnd Bergmann has put together a detailed plan for the eventual removal of high-memory support, which he calls "one of the least popular features of the Linux kernel". The intent is "to gradually phase out highmem over the next 2 years for mainline kernels". This plan is posted as a prompt for a discussion to be held at the Kernel Summit in December, so chances are it will evolve considerably in the next few months.

Comments (1 posted)

Three decades in kernelland

At Open Source Summit Europe, LWN's Jonathan Corbet presented "Three Decades in Kernelland"; the talk provides a look at how the kernel got to where it is, what makes it successful, and what may be coming next. The video of the talk is now online for LWN readers who would like to check it out.

Comments (11 posted)

Quotes of the week

Pro tip, when sending a bug to the kernel security team, and it's reviewed and shown to not actually be a bug at all due to the report being "written" by a llm which can't actually parse C very well, don't proceed to "curse" the reviewer for pointing this out.

— Greg Kroah-Hartman

Add a new 'b4 dig' subcommand that uses AI agents to discover related emails for a given message ID. This helps developers find all relevant context around patches including previous versions, bug reports, reviews, and related discussions.

The command:

• Takes a message ID and constructs a detailed prompt about email relationships
• Calls a configured AI agent script to analyze and find related messages
• Downloads all related threads from lore.kernel.org
• Combines them into a single mbox file for easy review

Key features:

• Outputs a simplified summary showing only relationships and reasons
• Creates a combined mbox with all related threads (deduped)
• Provides detailed guidance to AI agents about kernel workflow patterns

— Sasha Levin

Comments (none posted)

Anaconda WebUI: progress update and roadmap

Fedora's Community Blog has a short update on the progress of Fedora's new installer with a web-based interface. The new installer was introduced for the Workstation edition in Fedora Linux 42, it is now approved to be included in all Fedora spins and the KDE edition for Fedora 43. Final deprecation of the GTK-based installer is set for Fedora 45. LWN covered the installer changes in April.

Comments (none posted)

OpenSUSE disables bcachefs

The openSUSE project has announced that the bcachefs filesystem will be disabled in its kernel builds starting with 6.17; bcachefs users will have to make other arrangements. "The current 6.16.* is NOT affected. Neither is Slowroll (for now)."

Comments (64 posted)

Distributions quote of the week

Hey, that might be an interesting application / project. Lets look at its tagline/short description:

"AI Enabled...".

<closes tab>

— Kevin Fenzi

Comments (2 posted)

No more 32-bit Firefox support

Mozilla has announced that support for the Firefox browser on 32-bit systems ends with version 144. "For users who cannot transition immediately, Firefox ESR 140 will remain available — including 32-bit builds — and will continue to receive security updates until at least September 2026."

Comments (65 posted)

Development quote of the week

The TL;DR is that kpcyrd correctly identified the root cause as an issue due to the order of the object linking and Roland was pretty close in his remark about locales.

The real causes, however, are that GNU Make has some interesting and nonintuitive sorting tripwires and you were caught out with them due to an issue due to some particular filenames chosen by the upstream duperemove developers. [...]

This was because, in the Estonian et_EE.UTF-8 locale that reprotest uses, underscores sort after the numbers and letters. In the C locale, by contrast, underscores sort *before* the letters: "file_scan.o" is therefore placed before "filerec.o".

This is more of a slight weirdness in the C locale rather than something in ee_EE. (ee_EE is still a good choice for reprotest, however, because whilst en_US and friends sort the lower case before the upper case, et_EE.UTF-8 and the "C" locale sort capital letters before the lower case. Also, Estonian sorts the letter 'z' between 's' and 't'. Also, I'm fun at parties.)

— Chris Lamb

Comments (1 posted)