The Shai-Hulud malware campaign impacted hundreds of npm packages across multiple maintainers, reports Koi Security, including popular libraries like @ctrl/tinycolor and some packages maintained by CrowdStrike. Malicious versions embed a trojanized script (bundle.js) designed to steal developer credentials, exfiltrate secrets, and persist in repositories and endpoints through automated workflows. Koi Security created a table of packages identified as compromised, promising it's "continuously updated" (and showing the last compromise detected Tuesday). Nearly all of the compromised packages have a status of "removed from NPM". Attackers published malicious versions of @ctrl/tinycolor and other npm packages, injecting a large obfuscated script (bundle.js) that executes automatically during installation. This payload repackages and republishes maintainer projects, enabling the malware to spread laterally across related packages without direct developer involvement. As a result, the compromise quickly scaled beyond its initial entry point, impacting not only widely used open-source libraries but also CrowdStrike's npm packages. The injected script performs credential harvesting and persistence operations. It runs TruffleHog to scan local filesystems and repositories for secrets, including npm tokens, GitHub credentials, and cloud access keys for AWS, GCP, and Azure. It also writes a hidden GitHub Actions workflow file (.github/workflows/shai-hulud-workflow.yml) that exfiltrates secrets during CI/CD runs, ensuring long-term access even after the initial infection. This dual focus on endpoint secret theft and backdoors makes Shai-Hulud one of the most dangerous campaigns ever compared to previous compromises. "The malicious code also attempts to leak data on GitHub by making private repositories public," according to a Tuesday blog post from security systems provider Sysdig: The Sysdig Threat Research Team (TRT) has been monitoring this worm's progress since its discovery. Due to quick response times, the number of new packages being compromised has slowed considerably. No new packages have been seen in several hours at the time... Their blog post concludes "Supply chain attacks are increasing in frequency. It is more important than ever to monitor third-party packages for malicious activity." Some context from Tom's Hardware: To be clear: This campaign is distinct from the incident that we covered on Sept. 9, which saw multiple npm packages with billions of weekly downloads compromised in a bid to steal cryptocurrency. The ecosystem is the same — attackers have clearly realized the GitHub-owned npm package registry for the Node.js ecosystem is a valuable target — but whoever's behind the Shai-Hulud campaign is after more than just some Bitcoin.

Read more of this story at Slashdot.

Long-time Slashdot reader robinsrowe shared this report from the Register: The C++ standards committee abandoned a detailed proposal to create a rigorously safe subset of the language, according to the proposal's co-author, despite continuing anxiety about memory safety. "The Safety and Security working group voted to prioritize Profiles over Safe C++. Ask the Profiles people for an update. Safe C++ is not being continued," Sean Baxter, author of the cutting-edge Circle C++ compiler, commented in June this year. The topic came up as developers like Simone Bellavia noted the anniversary of the proposal and discovered a decision had been made on Safe C++. One year ago, Baxter told The Reg that the project would enable C++ developers to get the memory safety of Rust, but without having to learn a new language. "Safe C++ prevents users from writing unsound code," he said. "This includes compile-time intelligence like borrow checking to prevent use-after-free bugs and initialization analysis for type safety." Safe C++ would enable incremental migration of code, since it only applies to code in the safe context. Existing unsafe code would run as before. Even the matter of whether the proposal has been abandoned is not clear-cut. Erich Keane, C++ committee member and co-chair of the C++ Evolution Working Group (EWG), said that Baxter's proposal "got a vote of encouragement where roughly 1/2 (20/45) of the people encouraged Sean's paper, and 30/45 encouraged work on profiles (with 6 neutral)... Sean is completely welcome to continue the effort, and many in the committee would love to see him make further effort on standardizing it." In response, Baxter said: "The Rust safety model is unpopular with the committee. Further work on my end won't change that. Profiles won the argument." He added that the language evolution principles adopted by the EWG include the statement that "we should avoid requiring a safe or pure function annotation that has the semantics that a safe or pure function can only call other safe or pure functions." This, he said, is an "irreconcilable design disagreement...."

Read more of this story at Slashdot.

Micro- and nanoplastic particles "infiltrate all systems of the body, including the brain," notes the University of Rhode Island, "where they can accumulate and trigger Alzheimer's-like conditions, according to a new study by researchers in the University of Rhode Island College of Pharmacy." ScienceDaily shares the announcement: After a previous study that showed how microplastics can infiltrate all systems of the body — including the blood-brain barrier, which protects the brain from harmful substances as small as viruses and bacteria — University of Rhode Island pharmacy assistant professor Jaime Ross expanded the study to determine the brain health impacts of the plastic toxins. Her findings indicate that the accumulation of micro- and nanoplastics in the brain can lead to cognitive decline and even Alzheimer's disease, especially in those who carry genetic risk factors. Ross' latest study, published recently in the journal Environmental Research Communications, examined mice that had been genetically modified to include the naturally occurring gene APOE4, a strong indicator of Alzheimer's risk making people 3.5 times more likely to develop the disease than those who carry the APOE3 variant of the gene that is passed from parents to offspring... Ross and her team exposed two groups of mice — one with the APOE4 variant and one with APOE3 — to micro- and nanoplastics in their drinking water over a period of three weeks. The tiny particles from polystyrene — among the most abundant plastics in the world, found in Styrofoam take-out containers, plastic cups and more — infiltrated the mice' organs, including the brain, as expected... Ross' team then ran the mice through a series of tests to examine their cognitive ability, beginning with an open-field test, in which researchers put a mouse in a chamber and allow it to explore at will for 90 minutes. Ordinarily, a mouse will hug the walls, naturally attempting to hide from potential predators. However, after microplastic exposure, the APOE4 mice — especially the male mice — tended to wander more in the middle of the chamber and spend time in open space, leaving themselves vulnerable to predators... The results are concerning enough to warrant further study into the cognitive decline caused by exposure to micro- and nanoplastics, which are among the most prominent environmental toxins to which people are routinely exposed... Ross is continuing to expand her research into the topic and encourages others to do so, in the hope of leading to better regulation of the toxins.

Read more of this story at Slashdot.

"OpenAI's video generation tool, Sora, can create high-definition clips of just about anything you could ask for..." reports the Washington Post. "But OpenAI has not specified which videos it grabbed to make Sora, saying only that it combined 'publicly available and licensed data'..." With ChatGPT, OpenAI helped popularize the now-standard industry practice of building more capable AI tools by scraping vast quantities of text from the web without consent. With Sora, launched in December, OpenAI staff said they built a pioneering video generator by taking a similar approach. They developed ways to feed the system more online video — in more varied formats — including vertical videos and longer, higher-resolution clips... To explore what content OpenAI may have used, The Washington Post used Sora to create hundreds of videos that show it can closely mimic movies, TV shows and other content... In dozens of tests, The Post found that Sora can create clips that closely resemble Netflix shows such as "Wednesday"; popular video games like "Minecraft"; and beloved cartoon characters, as well as the animated logos for Warner Bros., DreamWorks and other Hollywood studios, movies and TV shows. The publicly available version of Sora can generate only 20-second clips, without audio. In most cases, the look-alike scenes were made by typing basic requests like "universal studios intro." The results also showed that Sora can create AI videos with the logos or watermarks that broadcasters and tech companies use to brand their video content, including those for the National Basketball Association, Chinese-owned social app TikTok and Amazon-owned streaming platform Twitch... Sora's ability to re-create specific imagery and brands suggests a version of the originals appeared in the tool's training data, AI researchers said. "The model is mimicking the training data. There's no magic," said Joanna Materzynska, a PhD researcher at Massachusetts Institute of Technology who has studied datasets used in AI. An AI tool's ability to reproduce proprietary content doesn't necessarily indicate that the original material was copied or obtained from its creators or owners. Content of all kinds is uploaded to video and social platforms, often without the consent of the copyright holder... Materzynska co-authored a study last year that found more than 70 percent of public video datasets commonly used in AI research contained content scraped from YouTube. Netflix and Twitch said they did not have a content partnership for training OpenAI, according to the article (which adds that OpenAI "has yet to face a copyright suit over the data used for Sora.") Two key quotes from the article: "Unauthorized scraping of YouTube content continues to be a violation of our Terms of Service." — YouTube spokesperson Jack Malon "We train on publicly available data consistent with fair use and use industry-leading safeguards to avoid replicating the material they learn from." — OpenAI spokesperson Kayla Wood

Read more of this story at Slashdot.

Libraries nationwide are fielding patron requests for books that don't exist after AI-generated summer reading lists appeared in the Chicago Sun-Times and Philadelphia Inquirer earlier this year. Reference librarian Eddie Kristan told 404 Media the problem began in late 2022 following GPT-3.5's release but escalated dramatically after the newspapers published lists created by a freelancer using AI without verification. A Library Freedom Project survey found patrons increasingly trust AI chatbots over human librarians and become defensive when told their AI-recommended titles are fictional. Kristan now routinely checks WorldCat's global catalog to verify titles exist. Collection development librarians are requesting digital vendors remove AI-generated books from platforms while academic libraries struggle against vendors implementing flawed LLM-based search tools and AI-generated summaries that undermine information literacy instruction.

Read more of this story at Slashdot.

The high seas, the vast waters beyond any one country's jurisdiction, cover nearly half the planet. On Friday, a hard-fought global treaty to protect the "cornucopia of biodiversity" living there cleared a final hurdle and will become international law. From a report: The High Seas Treaty, as it is known, was ratified by a 60th nation, Morocco, crossing the threshold for United Nations treaties to go into effect. Two decades in the making, it allows for the establishment of enormous conservation zones in international waters. Environmentalists hailed it as a historic moment. The treaty "is a conservation opportunity that happens once in a generation, if that," said Lisa Speer, who directs the International Oceans Program at the Natural Resources Defense Council. It is also a bright spot amid a general dimming of optimism about international diplomacy and cooperation among nations toward common goals. It will come into force just as the high seas are poised to become the site of controversial industrial activities including deep sea mining. The treaty provides a comprehensive set of regulations for high seas conservation that would supersede the existing patchwork of rules developed by United Nations agencies and industrial organizations in sectors like oil, fishing and shipping. Currently, less than 10 percent of the world's oceans are protected under law, and conservation advocates say little of that protection is effective. The treaty states a goal of giving 30 percent of the high seas some kind of protected status by 2030.

Read more of this story at Slashdot.

The Leon Thevenin, Africa's only permanently stationed cable repair ship, maintains over 60,000 kilometers of undersea internet infrastructure from Madagascar to Ghana. The 43-year-old vessel employs a 60-person crew who perform precision repairs on fiber-optic cables that carry data for Alphabet, Meta, and Amazon -- companies that consumed 3.6 billion megabits per second of bandwidth in 2023. Operating costs range from $70,000 to $120,000 daily, according to owner Orange Marine. The ship has experienced increased demand due to unusual underwater landslides in the Congo Canyon causing frequent cable breaks. Cable jointer Shuru Arendse and his team spend up to 48 hours on repairs that require fusing hair-thin glass fibers in conditions where a speck of dust can ruin the joint. The vessel gained Starlink connectivity last year after decades of relying on satellite phones and shared computers for crew communication. Sixty-two cable repair ships operate globally to maintain the infrastructure supporting streaming media and AI applications.

Read more of this story at Slashdot.

The Washington Post: The Trump administration unveiled a new crackdown Friday on journalists at the Pentagon, saying it will require them to pledge they won't gather any information - even unclassified - that hasn't been expressly authorized for release, and will revoke the press credentials of those who do not obey. Under the policy, the Pentagon may revoke press passes for anyone it deems a security threat. Possessing confidential or unauthorized information, under the new rules, would be grounds for a journalist't press pass to be revoked. "DoW remains committed to transparency to promote accountability and public trust," the document says, using an acronym for the newly rebranded Department of War. "However, DoW information must be approved for public release by an appropriate authorizing official before it is released, even if it is unclassified." For months, Defense Secretary Pete Hegseth and his staff have been tightening restrictions on Pentagon reporters while limiting military personnel's direct communication with the press. Like many defense secretaries before him, Hegseth has been deeply irritated by leaks. His staff this year threatened to use polygraph tests to stop people from leaking information, until the White House intervened.

Read more of this story at Slashdot.

Amazon's logistics network will now fulfill orders placed on Walmart.com, the company announced at its Accelerate seller conference, creating a surreal arrangement where the e-commerce giant directly supports its biggest retail rival's online operations. Third-party sellers can now use Amazon's Multichannel Fulfillment service to automatically process Walmart orders through direct integration. The packages arrive in unbranded boxes since Walmart prohibits Amazon-branded deliveries to its customers. Amazon VP Dharmesh Mehta told GeekWire the system automatically routes any Walmart order through Amazon's fulfillment network. The service expansion includes upcoming Shein integration and existing support for eBay, Etsy, and Temu. Amazon's third-party seller services generated $156 billion in 2024 revenue. The company now competes directly against ShipBob, FedEx, UPS, and ironically Walmart's own fulfillment services while positioning itself as an end-to-end logistics provider regardless of where the sale originates.

Read more of this story at Slashdot.

Just days after federal data revealed average reading, math and science scores dropped among certain grades since before the coronavirus pandemic, a U.S. Senate panel on Thursday picked apart the root causes and methods for students' academic improvement. From a report: The hearing in the Senate Committee on Health, Education, Labor and Pensions centered on the "state of K-12 education" -- which GOP members on the committee described as "troubling" -- in light of recent data from the National Assessment of Educational Progress, or NAEP. NAEP, regarded as the gold standard for tracking students' academic performance, showed that average science scores for eighth-graders decreased by 4 points since before the pandemic, in 2019. Average math and reading scores for 12th-graders also fell 3 points between 2019 and 2024. The assessments were administered between January and March of 2024. Results also showed that just one-third of 12th-graders are considered academically prepared for college in math -- a drop from 37% in 2019. The committee's chair, Sen. Bill Cassidy, said "it should concern us that children's reading, math and science scores have yet to recover to pre-pandemic levels." The Louisiana Republican added that "success in education is not determined by how much we spend, but by who makes the decision and how wisely resources are directed," and "when states and local communities are empowered to tailor solutions to meet the unique needs of students, innovation follows." On the other hand, Sen. Bernie Sanders, ranking member of the panel, said that "while we focus on education -- as important as that is -- we also have to focus on the conditions under which our children are living."

Read more of this story at Slashdot.

Gallup: A record-low 35% of Americans are satisfied with the quality of education that K-12 students receive in the U.S. today, marking an eight-percentage-point decline since last year. This is one point below the previous historical low recorded in 2000 and 2023 for this Gallup question that dates back to 1999. Several other ratings of the U.S. K-12 education system provide a similarly bleak assessment. Only about one-quarter of Americans think K-12 schools are headed in the right direction, while just one in five rate them as "excellent" or "good" at preparing students for today's jobs and one in three say the same for college. Yet, parents of current K-12 students are nearly twice as satisfied with their own child's education as they are with education in the U.S. K-12 parents are also slightly more likely than U.S. adults in general to rate different aspects of education positively, including the direction of education in the U.S. and schools' preparation of students for the workforce and for college. Still, none of these ratings is near the majority level.

Read more of this story at Slashdot.

U.S. President Donald Trump plans to impose a new $100,000 application fee for H-1B worker visas, a White House official said, potentially dealing a big blow to the technology sector that relies heavily on skilled workers from India and China. From a report: As part of his broader immigration crackdown, the Republican president was expected to sign a proclamation as early as Friday restricting entry under the H-1B visa program unless the application fee is paid, the official said. The H-1B program has become critical for technology and staffing companies who rely on foreign workers to fill a variety of technical roles. Amazon had over 10,000 H-1B visas approved in the first half of 2025, while Microsoft and Meta had over 5,000 H-1B visa approvals each, according to U.S. Citizenship and Immigration Services. Roughly two-thirds of jobs secured through the visa program are computer-related, according to U.S. government figures, but employers also use the visa to bring in engineers, educators and healthcare workers.

Read more of this story at Slashdot.

Microsoft will increase Xbox Series X and Series S console prices in the United States on October 3. The Series X rises to $649.99 from $599.99 and the 512GB Series S increases to $399.99 from $379.99. The 1TB Series S moves to $449.99 from $429.99. The Series X Digital Edition reaches $599.99 from $549.99 and the 2TB Galaxy Black Special Edition climbs to $799.99 from $729.99. Microsoft cited macroeconomic changes for the increases. Console prices outside the US and controller and headset prices domestically remain unchanged. The company raised console prices globally in May.

Read more of this story at Slashdot.

Meta is moving to break into the wholesale power-trading business to better manage the massive electricity needs of its data centers. Bloomberg: The company, which owns Facebook, filed an application with US regulators this week seeking authorization to do so. A Meta representative said it was a natural next step to participate in energy markets as it looks to power operations with clean energy. Buying electricity has become an increasingly urgent challenge for technology companies including Meta, Microsoft and Alphabet's Google. They're all racing to develop more advanced artificial intelligence systems and tools that are notoriously resource-intensive. Amazon, Google and Microsoft are already active power traders, according to filings with US regulators.

Read more of this story at Slashdot.

An analysis of tens of thousands of research-paper submissions has shown a dramatic increase in the presence of text generated using AI in the past few years, an academic publisher has found. Nature: The American Association for Cancer Research (AACR) found that 23% of abstracts in manuscripts and 5% of peer-review reports submitted to its journals in 2024 contained text that was probably generated by large language models (LLMs). The publishers also found that less than 25% of authors disclosed their use of AI to prepare manuscripts, despite the publisher mandating disclosure for submission. To screen manuscripts for signs of AI use, the AACR used an AI tool that was developed by Pangram Labs, based in New York City. When applied to 46,500 abstracts, 46,021 methods sections and 29,544 peer-review comments submitted to 10 AACR journals between 2021 and 2024, the tool flagged a rise in suspected AI-generated text in submissions and review reports since the public release of OpenAI's chatbot, ChatGPT, in November 2022.

Read more of this story at Slashdot.

Chinese consumer tech giant Xiaomi will remotely fix a flaw in the assisted driving system on over 110,000 of its popular SU7 electric cars, the firm and regulators said Friday, months after a deadly crash involving the model. From a report: China's tech companies and automakers have poured billions of dollars into smart-driving technology, a new battleground in the country's cutthroat domestic car market. But Beijing has moved to tighten safety rules after a Xiaomi SU7 in assisted driving mode crashed and killed three college students this year. It also raised concerns over the advertising of cars as being capable of autonomous driving. On Friday, the State Administration for Market Regulation said Xiaomi's highway assisted driving system showed insufficient recognition, warning and handling ability in some extreme driving conditions.

Read more of this story at Slashdot.

US wholesale electricity prices have nearly doubled since 2020, rising faster than consumer rates across most regional grid operators. Analysis of location marginal pricing data from 17 trading hubs shows average wholesale costs increased from baseline 2020 levels to peaks 2-4 times higher by 2022, before partially recovering. Consumer electricity prices rose 35% during the same period. Transmission congestion spreads are widening in most Independent System Operators and Regional Transmission Organizations, particularly in PJM, SPP, and NYISO, where bottlenecks increasingly prevent access to cheaper generation. California's CAISO stands alone among major grid operators as wholesale prices remain flat or decline in 2025 despite natural gas volatility. The cheapest wholesale electricity continues to trade in SPP's Oklahoma-Kansas region at $16-17 per megawatt-hour.

Read more of this story at Slashdot.

alternative_right writes: Austria's armed forces have switched from Microsoft's Office programs to the open-source LibreOffice package. The reason for this is not to save on software license fees for around 16,000 workstations. "It was very important for us to show that we are doing this primarily (...) to strengthen our digital sovereignty, to maintain our independence in terms of ICT infrastructure and (...) to ensure that data is only processed in-house," emphasizes Michael Hillebrand from the Austrian Armed Forces' Directorate 6 ICT and Cyber. This is because processing data in external clouds is out of the question for the Austrian Armed Forces, as Hillebrand explained on ORF radio station O1. It was already apparent five years ago that Microsoft Office would move to the cloud. Back then, in 2020, the decision-making process for the switch began and was completed in 2021.

Read more of this story at Slashdot.

An anonymous reader shares a report: JM Video, one of only two remaining DVD rental stores in Paris, is a focal point for film lovers and visited by actors like Brad Pitt when they are in the city, but the ever-growing competition of streaming platforms means this Paris institution is fighting for survival. Choice is not the problem: JM Video has a library of more than 50,000 films, more than some 5,000 on offer at any time on Netflix and more than the catalogues of all the major streaming actors combined. "It's one of the few places in Paris with a real film collection, you can find things here that you cannot find anywhere else," said movie buff Virginie Breton, who rents DVDs several times a week. But not enough to keep JM Video afloat. Sky-high Paris property rents and a dwindling customer base, combined with the arrival of ever-more streaming services like Amazon Prime, Disney+, HBO Max, Paramount+ and Apple TV+ are squeezing the life out of the cave-like shop, where DVDs spill out from floor-to-ceiling racks. Founded in 1982, JM Video was one of around 5,000 video rental shops in France at the end of last century, well before Netflix switched from being a DVD rental outfit to a streaming pioneer around 2010. Now, France has only about 10 DVD rental shops, two of which are in Paris.

Read more of this story at Slashdot.

Valve is dropping support for Steam running on 32-bit versions of Windows, starting January 1, 2026. A report adds and comments: Steam has been available on Windows for more than two decades and, therefore, was built with 32-bit systems in mind. Today, every modern computer is 64-bit, with compatibility layers built in to support older 32-bit apps. So, even though 32-bit apps have carried forward, there's really no place for 32-bit operating systems anymore -- which is why Valve is axing support for them.

Read more of this story at Slashdot.