Malicious Pull Request Inserted Into Ethereum Code Extension: Research

Key Points

1. A GitHub repository for ETHcode, an Ethereum development tool, was compromised with malicious code added by a user named Airez299, which went unnoticed by GitHub's AI reviewer and the ETHcode team.

2. The malicious code was obfuscated and designed to create an automated function, potentially affecting thousands of developers who installed the ETHcode extension.

3. Ethereum developer Zak Cole warns about the ease of inserting malicious code into open-source packages, citing past incidents like the Ledger Connect Kit exploit and Solana's web3.js library malware.

4. North Korean-affiliated hackers are using a Python-based remote access trojan called 'PylangGhost' to target crypto professionals through hiring scams.

5. The article also briefly mentions unrelated topics such as rescue drone deployments during floods, Japan's Minna Bank exploring stablecoins on Solana, and Bitcoin Alkanes as a potential innovation.