News

On today's episode of CNBC Crypto World, Robinhood shares climb after the retail trading platform completes its acquisition of Bitstamp, which gives the firm an immediate international footprint. Plus, Bitwise CEO Hunter Horsley sits down with CNBC from Bitcoin 2025 to discuss bitcoin's new record, crypto ETFs and regulatory advancements for digital assets in the U.S. And also speaking from Bitcoin 2025, Kraken CEO Dave Ripley discusses crypto regulations he's hoping Congress will pass.

A single typo could let hackers hijack your system using malware hidden in fake packagesCross-platform malware now fools even experienced developers by mimicking trusted open source package namesAttackers are exploiting developer trust with stealthy payloads that dodge malware protection toolsA new supply chain attack has revealed how something as innocuous as a typo can open the door to serious cybersecurity threats, experts have warned.A report from Checkmarx claims malicious actors are using clever tricks to deceive developers into downloading fake packages, which can then give hackers control of their systems.The attackers primarily target users of Colorama, a popular Python package, and Colorizr, a similar tool used in JavaScript (NPM).Deceptive packages and the threat of typos“This campaign targets Python and NPM users on Windows and Linux via typosquatting and name-confusion attacks,” said Ariel Harush, a researcher at Checkmarx.The attackers use a technique called typosquatting. For example, instead of “colorama,” a developer might accidentally type “col0rama” or “coloramaa” and download a harmful version.These fake packages were uploaded to the PyPI repository, which is the main source of Python libraries.“We've found malicious Python (PyPI) packages as part of a typosquatting campaign. The malicious packages allow for remote control, persistence, etc.,” said Darren Meyer, Security Research Advocate at Checkmarx.What makes this campaign unusual is that the attackers mixed names from different ecosystems, useing names from the NPM world (JavaScript) to trick Python users.This cross-platform targeting is rare and suggests a more advanced and potentially coordinated strategy.The Windows and Linux payloads have similar upload timings and naming but use different tools, tactics, and infrastructure, which means they may not be from the same source.Once installed, the fake packages can do serious damage - on Windows systems, the malware creates scheduled tasks to maintain persistence and harvest environment variables, which could include sensitive credentials.It also attempts to disable even the best antivirus software using PowerShell commands like Set-MpPreference -DisableIOAVProtection $true.On Linux systems, packages like Colorizator and coloraiz carry encoded payloads to create encrypted reverse shells, communicate via platforms like Telegram and Discord, and exfiltrate data to services like Pastebin.These scripts are not executed all at once; they are designed for stealth and persistence, using techniques like masquerading as kernel processes and editing rc.local and crontabs for automatic execution.Though the malicious packages have been removed from public repositories, the threat is far from over.Developers should be very careful when installing packages because even the best endpoint protection platforms struggle with these evasive tactics. Always double-check the spelling and make sure the package comes from a trusted source.Checkmarx recommends that organizations audit all deployed and deployable packages, proactively examine application code, scrutinize private repositories, and block known malicious names.You might also likeThese are the best VPNs with antivirus you can use right nowTake a look at our pick of the best internet security suitesIranian hackers pretend to be a modelling agency to try and steal user details

A deck-building game with soulslike elements is an odd genre mashup, to say the least. But that's what the three-person Danish studio The Outer Zone is creating with Death Howl. The second demo for the indie PC title launches next week on Steam.

The unusual blend of genres isn't the game's only hallmark. Death Howl also has a gorgeous art style and music to match its rich themes. You play as Ro, a hunter from a small tribe, who is grieving her son's death. Mystical voices beckon her toward a spirit realm as she tries to bring him back. Ro's adventure leads her on a journey of "love, loss and the slow path toward acceptance."

The game's deck-based combat will unlock various melee and ranged spell attacks. As you progress, you'll craft cards built around your preferred tactical style. Meanwhile, shamanic totems will enhance your deck and buff up your strikes.

The Outer Zone / 11 Bit Studios

What makes it soulslike, besides being hard? Publisher 11 Bit Studios offered some insight on Reddit. "Initially, we thought about a different label for Death Howl," the publisher wrote. "But as we played it more and brought in random testers, we noticed something surprising. The game, despite not being an action RPG, does feel like a soulslike. It evoked emotions similar to what you experience in a soulslike." Meanwhile, the game's difficulty reveals itself most in boss battles and side quests.

Death Howl doesn't arrive until sometime later this year. But the second demo will be playable from June 9 to 16. Head to the game's Steam page to check it out. In the meantime, you can watch its new trailer below.

This article originally appeared on Engadget at https://www.engadget.com/gaming/pc/the-gorgeous-indie-game-death-howl-will-have-a-new-demo-on-june-9-205057519.html?src=rss