Mozilla Revokes GPG Signing Key After Accidental Upload to Private GitHub Repository
Mozilla has revoked and replaced a GPG signing key after an unencrypted copy of the secret key was accidentally uploaded to a private GitHub repository. The key had been used to sign Linux archives, RPM packages, and associated checksum files for Firefox and Thunderbird.
The incident created a theoretical risk that an attacker could have used the key to sign malicious installers and present them as official releases. However, Mozilla assessed the supply-chain risk as low because the repository was accessible only to a limited group of internal employees who already possessed legitimate access to the key.
Audit log reviews showed no indications that the key had been accessed or misused by unauthorized parties. As a result, the company revoked the old key and issued a replacement that will remain valid until 5 August 2028.
Most end users do not need to take any action. Individuals who manually verify GPG signatures on downloaded files must import the new public key and the revocation certificate for the previous key.
Users installing Firefox from RPM packages on Linux distributions may face additional steps. Depending on the distribution, they will need to update the signing key manually; otherwise, newer browser versions may fail to install. Mozilla has published specific instructions for Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE.
Thunderbird users are not affected by the RPM-related instructions because the mail client does not provide official RPM packages. Updated public key material and revocation information are available in the current KEY files for Firefox Nightly and on the keys.openpgp.org server.
Mozilla stated it will implement additional safeguards to prevent secret keys from being committed to repositories in the future.
Related articles
ChainDrop Malware Infects Over 1,300 npm Packages in Record Supply Chain Poisoning Campaign
Security researchers have uncovered a massive supply chain attack involving the ChainDrop malware that compromised more than 1,300 npm packages with a combined 2 billion monthly downloads. The malicious code silently steals npm tokens, GitHub credentials, and SSH keys before using stolen tokens to infect additional packages in a self-propagating loop. In a parallel incident, the Open VSX marketplace removed 77 malicious extensions that impersonated popular developer tools and harvested host and repository data. Attackers have also begun exploiting AI coding assistants through a technique called HalluSquatting, registering packages that match hallucinated names suggested by tools such as GitHub Copilot and Claude Code. The incidents highlight how modern supply chain threats now extend beyond direct dependencies to include AI-generated recommendations and automated publishing pipelines. Experts recommend strict lockfile usage, minimal token permissions, and manual verification of any package suggested by AI assistants.
Malicious VS Code Extensions Masquerading as Solidity Tools Steal Crypto Wallets, API Keys and Credentials
Two malicious Visual Studio Code extensions promoted as Solidity development utilities have been used to steal cryptocurrency wallet data from browsers along with API keys and stored credentials. The extensions, identified as helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, target developers working with smart contracts and Web3 environments where sensitive tokens and sessions are commonly present. Attackers rely on the trusted VS Code marketplace to deliver the payload through a simple installation rather than any complex exploit. Once active, the extensions harvest browser-based crypto wallet information, saved credentials, environment files, SSH keys and API tokens. A single compromised workstation can therefore expose repositories, cloud services and directly drain cryptocurrency funds. Security researchers recommend immediate removal of both extensions, rotation of all accessible secrets and adoption of stricter extension allow-list policies. The incident highlights ongoing supply-chain risks in developer tooling ecosystems.
Supply Chain Attack Targets Arch Linux Community Repository
Arch Linux has temporarily suspended package adoptions in the Arch User Repository after detecting accounts taking over abandoned projects to insert malicious code. The platform later expanded the restriction by blocking all new submissions to the AUR to contain ongoing supply chain attacks. Attackers were adopting packages without active maintainers and introducing harmful changes through subsequent commits that could bypass user scrutiny due to established project history. Newly created packages containing malicious build commands, including requests for elevated privileges, were also discovered. Affected accounts have been banned and identified projects removed from the repository. The incident does not impact official Arch Linux repositories, with risk limited to community-maintained AUR packages that require manual review of PKGBUILD files before installation or updates.
Malicious npm Packages Deploy Multi-Stage Trojan with Embedded GitLab Keys
Positive Technologies researchers uncovered a campaign in which an attacker published multiple trojanized packages to the npm registry under the accounts alex05255, mdrafiqulislamrabby, b.w1001, abdev8773 and mollspotwood54400. The affected packages include svg-fetcher, tradepilot, polytrade, polymarket-kit, react-svg-chunk, gamified-trading-system, font-huge, font-hub, mdb-vite, router-processor and route-processor. Each package concatenates several constants to build a C2 URL, downloads the next stage identified as token versions 106, 107, 108 and 116, and sends the hardcoded value logo in the bearrtoken header. Later stages contain heavily obfuscated JavaScript that collects username, hostname and operating-system information before establishing a WebSocket channel for command execution. Releases 106 and 116 also embed a public-private key pair belonging to a private GitLab instance operated by the threat actor, suggesting the use of CI/CD pipelines for code obfuscation and stage generation. The findings highlight the continued risk of supply-chain attacks through popular open-source repositories and the value of automated package monitoring.