SlowMist: A new malware family has emerged in the Go module ecosystem, targeting developer environments of Cosmos SDK projects.
Foresight News reports that blockchain security company SlowMist posted on Twitter that the malicious software families Mini Shai-Hulud, Miasma, and Hades have expanded from npm to the Go module ecosystem. The affected project is a specific version based on the Cosmos SDK L1 project verana-labs/verana. The malicious code is hidden in the .claude/ directory in an obfuscated form, and is executed via files such as .claude/setup.mjs and .vscode/setup.mjs by leveraging workflows of VS Code and AI assistants, triggered when developers open the repository.
This attack is not a traditional build-time supply chain attack, but rather targets developers' local environments. The risk lies in the abuse of IDE automation and AI-assisted tools. Developers are advised to avoid opening untrusted repositories when IDE automation is enabled, to thoroughly audit files related to .claude and .vscode, and to rotate any potentially leaked credentials.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Allegion Buys Overly Door Company
05:37 PM EDT, 10/05/2026 (MT Newswires) -- Allegion (ALLE) said late Monday it has acquired privately held Overly Door Company, a manufacturer of custom specialty doors for acoustic, blast, bullet-resistant and vault security. Overly, based in Greensburg, Pennsylvania, will operate as part of the Allegion Americas segment, it said. Terms of the transaction weren't disclosed.
Updated Version 3 - According to the Financial Times, McKesson and CD&R are close to reaching a deal worth more than $5 billion to acquire Option Care.
In the fifth paragraph, a quote from analyst Sahil Pandey was added. Reuters, October 5 - According to the Financial Times, citing informed sources, pharmaceutical distributor McKesson (MCK.N) and private equity firm Clayton Dubilier & Rice are about to reach an acquisition agreement to purchase infusion service provider Option Care Health, with the deal valued (including debt) at over 5 billions USD. After the report was published, Option Care's share price rose by 21% in after-hours trading. The report stated that the deal could be announced as early as Tuesday, but negotiations could still fall through. This potential acquisition would be McKesson’s latest move in expanding its healthcare services portfolio. In August this year, the company agreed to acquire Precision Medicine Group for about 2.25 billions USD (link), as part of its effort over the years to strengthen high-growth business sectors. Leerink Partners analyst Michael Cherny said the “strategic logic” of the deal makes sense, as it would expand McKesson’s business from physician offices to care settings in the home and alternative sites. Option Care provides infusion services that allow patients to receive intravenous treatments at home or other outpatient settings, eliminating the need to go to the hospital. McKesson has previously been restructuring its business portfolio by divesting non-core assets and investing in fields such as oncology and specialty care (link). Driven by the growth of its specialty distribution business and contributions from acquisitions, revenue for its oncology and multi-specialty business segment grew by 33% in the latest fiscal quarter. McKesson declined to comment, while CD&R and Option Care did not immediately respond to Reuters’ requests for comment regarding the report. (For non-English speakers' convenience, Reuters offers automated machine translations of its reports in several languages. As there may be mistakes in the automated translations or some context may not be included, Reuters does not guarantee the accuracy of the automated translation text, which is provided solely for readers’ convenience. Reuters bears no responsibility for any damages or losses caused by the use of automated translation functions.)
Centalion acquires Hainesville natural gas assets from Silver Hill
Reuters, October 5 - Centalion Group announced on Monday that it has acquired upstream and midstream natural gas assets in the Haynesville region of Texas and Louisiana from Texas-based private shale company Silver Hill Energy Partners. The commodities trader, formerly known as Gunvor, rebranded as Centalion Group last week (link), and stated plans to relocate its corporate headquarters from Cyprus to Singapore. A spokesperson for Centalion Group said the Haynesville platform, composed of Post Oak and Silver Hill assets, has an enterprise value of approximately $2 billion. In August, Reuters cited sources stating that Centalion Group (link) was negotiating the acquisition of Silver Hill's assets, with a deal valued between $1.2 billion and $1.5 billion. The assets currently produce about 300 million cubic feet per day of natural gas (MMcfd), and the portfolio includes approximately 72,000 net acres in the Haynesville and Bossier development areas. "Our consideration was to establish operations in this basin, a hub for both domestic and export markets, in order to seize this option and create value from it," the spokesperson added. (To assist non-English speakers, Reuters offers automated translation of its reports into several other languages. Due to possible errors in automated translations or missing required context, Reuters does not guarantee the accuracy of automated translation texts, and provides them solely for readers' convenience. Reuters is not liable for any damages or losses resulting from the use of the automated translation feature.)
