When you think of wartime cryptography, you probably think of World War II and Enigma, although there were other famous codes used during that war. But in fact, there have been codes used through wars and in peacetime for much longer. Even the Romans used codes. Of course, World War I, or The Great War, as it would have been known, had its share of codes and, as you might expect, most of these have been broken long ago. Most of them. But apparently an AI model, GPT-6 Astra, recently cracked one that was previously undeciphered.

If you aren’t up on century-old cryptography, the ADFGVX cipher appeared in 1918. It began as ADFGX, but after a few months grew an extra letter — and a larger grid. The letters were chosen because their Morse-code patterns were relatively easy to distinguish: A, D, F, G, V, and X.

The original ADFGX version used a 5×5 grid containing the alphabet, usually merging I and J. The later ADFGVX version expanded this to 6×6, making room for all the letters and the digits as well.

Encoding required a 5×5 (or 6×6) grid with the alphabet within. The table’s rows and columns were labeled… you guessed it… ADFGX pr ADFGVX. Each plaintext letter gets replaced by the corresponding row and column such as AF or XG. Finally, the letter pairs would be written under a transposition key.

Concatenating those pairs gives AGXGDDDXXF. Written in five columns under CANDY, the first row is AGXGD and the second is DDXXF.

Next, you sort the letters in the transposition key, taking the columns along with the letters. That would make the transposition key ACDNY, and the first row would now be GAGXD. Then the message is sent by columns. Too much to wrap your head around? Visit dCode and plug in some plain text, squares, and keywords for yourself.

The French broke the code in 1918, but without computers it was tough work. Codebreaker [Georges Painvin] reportedly worked on the cipher until it made him ill, but he did solve it. However, some of the intercepted messages remained a mystery. One in particular was sent on November 27, 1918. Apparently, the message used the codeword TRUPPENVERSCHIEBUNG, a German key believed to have gone into service in December. If this decoding is correct, then this message used it even earlier.

The message was, of course, in German and appears to be a report about a British ship’s movements near Sevastopol. In fact, HMS Canterbury’s position on the dates mentioned matches the message.

Honestly, we were more impressed that people like [Georges Painvin] in 1918 were able to decode these intercepted messages. But it is still an interesting glimpse into the capabilities of Astra.

It seems that as long as there has been writing, there have been ways to send secret messages. The Swiss in The Great War had their own encryption method.

The desktop headphone market is starting to look a lot like the rest of high-end audio: fewer boxes, fewer cables, and more functionality packed into a single component. Instead of assembling separate DACs and headphone amplifiers, listeners can increasingly choose one-box solutions designed to handle digital conversion, amplification, source switching, and even preamplifier duties without surrendering performance.

That is precisely the problem the Sendy Audio KYLIN is trying to solve. At $1,499/£1,499, however, simply combining a DAC and headphone amplifier in one handsome chassis is no longer enough. This has become a fiercely competitive category, and buyers spending this much should expect excellent sound, enough power for demanding headphones, useful connectivity, low noise, strong build quality, and the ability to genuinely replace multiple components on the desktop.

Sendy Audio has been one of my favourite headphone manufacturers in recent years. The Aiva 2 impressed me with its craftsmanship and engaging presentation, while the Egret has been one of my favourite planar magnetic headphones of the year so far.

I first listened to the KYLIN at CanJam London and enjoyed it enough that I wanted to spend considerably more time with one away from the noise and chaos of an audio show. Having now lived with it, that initial attraction is still very much there.

But at $1,499/£1,499, excellent sound is only the price of admission. The more important question is whether the Sendy Audio KYLIN does enough to justify replacing a stack of very capable DACs and headphone amplifiers already competing for the same space on your desk.

Related Reading:

Inside the Sendy Audio KYLIN: DAC, Class A Amplification and Connectivity

The KYLIN represents Sendy Audio’s move beyond headphones and into desktop electronics, combining a DAC, preamplifier, and headphone amplifier inside a single, substantial aluminium chassis.

Digital conversion is handled by the familiar ESS ES9038Q2M DAC, partnered with an XMOS USB implementation. Sendy Audio specifies support for native DSD512 playback, while digital connectivity includes USB-B, coaxial, and optical inputs.

Rather than building the KYLIN around the kind of highly integrated amplifier topology that has become commonplace in modern desktop DAC/amps, Sendy has gone with a Class A output stage employing matched Hitachi transistors. Dual Burr-Brown OPA604 op-amps are used in the preamplifier section, with WIMA and Nichicon capacitors also featuring internally.

This is not really trying to compete with products from Topping, FiiO, and similar manufacturers by offering the longest feature list or the most extravagant collection of measurements. The KYLIN feels much more like an old-school headphone amplifier that happens to have a very capable DAC built into it.

Three headphone connections are provided on the front panel: 6.35mm, 4.4mm, and four-pin XLR. Around the back are USB-B, coaxial, and optical digital inputs, alongside three sets of RCA analogue inputs and RCA preamplifier/line-level connectivity.

At this price, I would have liked balanced XLR line outputs. There is certainly enough room on the rear panel, and I am not convinced that three sets of RCA analogue inputs will prove more useful to most buyers than having the option of balanced connectivity to active loudspeakers or a separate power amplifier.

Furthermore, the KYLIN provides an altogether more analogue user experience. There are no digital filters to cycle through, no parametric EQ, no large colour interface, and no labyrinth of internal settings to configure. There is not even a remote control. Depending on your perspective, that will either sound refreshingly simple or surprisingly limited.

Plenty of considerably cheaper DAC/amps now offer PEQ, extensive filter controls, Bluetooth, saved profiles, and increasingly sophisticated software ecosystems. Some all-in-one components are even beginning to dabble in AI-assisted functionality.

The KYLIN gives you knobs, switches, and two physical VU meters. I suspect Sendy Audio is perfectly happy with that distinction.

Design & Build

Inside the box, Sendy Audio supplies the KYLIN with the necessary power cable alongside an unusually generous collection of interconnects, including RCA, optical, and multiple USB cables intended to cover the most common computer and mobile-device configurations. It is one of those rare products where you can open the box and have a very good chance of finding the cable you actually need rather than immediately rummaging through a drawer or making another online purchase.

I think the unit itself is beautifully made. That should not come as an enormous surprise if you have handled Sendy Audio’s cans before. Its headphones place considerable emphasis on materials and machining, and the KYLIN takes a similar approach to desktop electronics.

At 245 x 225 x 50mm (9.6 x 8.9 x 2 inches) and roughly 3.1kg, it is not especially large, but there is enough weight to stop it from moving around the desk every time you connect a pair of headphones.

The centrepiece is unquestionably the pair of analogue VU meters. Of course, they are not exactly necessary, but they do look cool. Screens have become almost unavoidable on modern desktop audio equipment. The advantage is obvious when a product has dozens of settings, filters, and input modes, but there is something satisfying about using an amplifier that does not resemble another small computer sitting next to my PC.

The volume knob deserves particular praise because it feels excellent. There is real weight to its movement, with enough resistance that adjustments feel deliberate and precise rather than loose or vague.

Unfortunately, the KYLIN has an unusually small usable window before things get loud. Even with the HiFiMAN HE6se V2 — hardly a headphone famous for being easy to drive — I was operating within roughly the first 10% of the potentiometer’s travel for much of my normal listening. Small movements therefore create disproportionately large changes in output level.

That is irritating with demanding headphones and becomes a much bigger problem with efficient ones. Fine adjustment at lower listening levels is far more difficult than it should be.

There is also audible background noise with sufficiently sensitive headphones. I could hear a noise floor with easy to drive full size dynamic headphones such as the THIEAUDIO Cypher, and I would be very cautious about buying the KYLIN primarily for sensitive IEMs.

Unless you listen to a lot of classical music with very wide dynamic range, extended rests, or extremely quiet passages, the noise floor should not pose a significant problem in normal use. But for a $1,499 headphone amplifier, it is still something that should not really be there.

There are certainly no complaints about the thermal performance, though. Despite the Class A design, the chassis only became lukewarm to the touch during extended use. Having spent time with products such as the Aune S17 Pro and LAiV Audio Crescendo VERSE, both of which can generate considerably more heat, I was expecting the Sendy Audio to become rather toasty. It never did.

That makes the KYLIN much easier to live with on a normal desk and gives you far more freedom over placement than some other Class A designs.

Listening & Headphone Synergy

The Sendy Audio KYLIN was used primarily as an all-in-one DAC and headphone amplifier with a range of planar magnetic and dynamic driver headphones. I fed the unit a mixture of high resolution FLAC files and Spotify streams from both my PC and smartphone.

As mentioned previously, my first proper listen to the KYLIN was at CanJam London, where its combination of warmth, dynamics, and physicality immediately stood out. I can now say that those initial impressions have largely survived extended listening.

Perhaps the best thing about the KYLIN is just how dynamic it sounds. Bass has real texture and physical presence, with enough weight behind kick drums and bass guitars to give music a convincing sense of scale. Transients have plenty of impact, and the KYLIN never sounds short of energy, especially in the low end, even when connected to more demanding planar magnetic headphones.

I especially enjoyed listening to Michael Jackson’s “Billie Jean,” where the recurring bassline punched through the rest of the track and gave the song even greater impact.

There is also a subtle old school Class A warmth to its presentation. It is not thick or syrupy in the traditional sense, but there is a little additional richness through the lower registers and midrange that gives instruments more body without completely neutering treble energy.

For that reason, I think the KYLIN pairs especially well with dead neutral headphones such as the HiFiMAN HE1000 Unveiled, adding a hint of cosiness that can otherwise be missing at times. It can also help tone down particularly spicy sections of certain tracks. Hans Zimmer’s “2049” can cause listening fatigue with some systems, but I had no such issues with the KYLIN.

As alluded to previously, the unit also has no trouble driving some of the most demanding headphones currently on the market. The HE6se V2 has earned a reputation for exposing amplifiers that look powerful on paper but struggle to provide convincing control and dynamic authority in practice. Despite this, the KYLIN had plenty of headroom while retaining bass impact and definition, and large dynamic swings never collapsed or became noticeably compressed.

British rapper AJ Tracey’s “Wifey Riddim 4” delivered the level of hard hitting impact I was looking for with the KYLIN paired with the Sendy Audio Egret.

The subtle warmth continues into the midrange, where vocals and guitars possess a pleasing sense of density without obscuring detail. There is enough clarity through the upper midrange and treble to prevent the KYLIN from becoming overly romantic, and it manages to retain a sense of openness despite its richer tonal balance.

That is refreshing in a market dominated by components chasing neutrality and increasingly impressive measurements. The KYLIN still sounds similarly clean and resolving to products from Topping or SMSL, but it adds a degree of dynamic exuberance and tonal character that gives the presentation some personality.

The Bottom Line

In an era when a DAC/headphone amplifier costing under $500 can offer colour touchscreens, Bluetooth, parametric EQ, a myriad of filters, and enough menu options to keep you occupied for an entire day, the $1,499 Sendy Audio KYLIN might not initially seem like the most enticing all in one option. It has physical VU meters, conventional controls, and very little in the way of software.

But that more analogue user experience will be exactly what some listeners are looking for. It allows you to focus on the music rather than constantly fiddling with settings in an attempt to make the listening experience that little bit more convenient.

And the KYLIN simply sounds magnificent. It has acres of power, a slightly warm tonal balance that draws attention to its powerful and immaculately controlled bass performance, yet still manages to retain a high level of detail and spatial precision. That is a difficult balance to achieve. The unit is also beautifully constructed, with a reassuring heft and level of finish that make it feel every bit like a serious piece of desktop audio equipment.

Just be aware of the lack of balanced XLR line outputs and the fact that the KYLIN is not the best companion for sensitive IEMs or easy to drive dynamic headphones, owing to its audible noise floor and very narrow usable volume range.

Pros:

• Beautifully constructed chassis with excellent physical controls
• Analogue VU meters give the KYLIN real character
• Substantial power for difficult full-size headphones
• Excellent pairing with hard-to-drive planar headphones
• Dynamic, textured bass response
• Slight Class A warmth without excessive treble roll-off
• Runs surprisingly cool for a Class A desktop amplifier
• Generous selection of supplied cables

Cons:

• Very narrow usable range on the volume control
• Audible noise floor with sensitive headphones
• No balanced XLR line outputs or remote control
• No PEQ, digital-filter selection or extensive internal configuration

Our Ratings:

★★★★★★★★★★ Sound Quality

★★★★★★★★★★ Build Quality

★★★★★★★★★★ Usability

★★★★★★★★★★ Features

★★★★★★★★★★ Value

Where to Buy:

Related Reading:

There’s no denying the appeal of deep-fried foods, from donuts to drumsticks, plus numerous bite-sized appetizers and every kind of potato. But when it comes to whether to bother deep-frying at home, it isn’t necessarily a matter of difficulty. With the right vessel and thermometer, frying can be a quick, easy way to make memorable dishes — the real issue is: what to do with all that leftover oil?

Shallow frying can also get the job done in many cases, but it can also create a conundrum. Putting that oil down the sink? Potentially drain-clogging, environmentally dubious, and frankly, wasteful. I grew up in a household where leftover grease and oil went into a glass mayonnaise jar kept under the sink, to be discarded once it was full. Sure, this saves the sink, but it doesn’t address the other two issues. It’s a quick kitchen hack that makes it easier to put it out with food waste, but there’s also another solution.

Don’t get rid of it. “Oil used for frying is not one and done,” says Melanie Underwood, cookbook author, culinary instructor, and founder of Nourish and Gather, “unless the oil has been overheated, or if you’re frying things that are particularly strong in flavor. With something like seafood, you want to be careful, but it’s perfectly reusable as long as it wasn’t smoking.”

With that, Underwood shares her best practices and advice for reusing oil multiple times before it’s done.

Manage the oil before and during the frying process

To ensure oil is good for multiple uses, first make sure you’re using the right oil — something neutral in flavor with a high smoke point. “Any vegetable oil, such as canola oil, peanut oil or sunflower oil, is best for frying,” says Underwood. While olive oil can be tricky to fry with because it has a lower smoke point, “I definitely have used olive oil,” she says, “and I have never had any problem with it whatsoever.”

Resist the impulse to eyeball your oil for temperature clues, or test bits and pieces to make sure you’re in the right zone, unless you fry so regularly that it’s second nature. Otherwise, that’s a recipe for pieces with burnt exteriors and undercooked interiors, and/or smoking out your upstairs neighbors. (Speaking from experience, sadly.) Using a thermometer, “the correct range for frying is usually between 350 to 400,” says Underwood, which prevents smoking.

During the frying process, it’s a great idea if you can skim out any crumbs or whatever has come off in the oil,” she says, “because when you have little burned pieces, that will degrade the oil faster.”

After frying: cool, strain, and store

Once you’re done frying, managing the oil for future use is simple. “First, you let it cool,” says Underwood. Don’t try to speed up the process by refrigerating it; just let it sit until it cools to room temperature.

Straining it is also straightforward and can be done with whatever you already have on hand. “I use a fine mesh strainer,” Underwood says. “People also use cheesecloth or a coffee filter. You just want to strain it and get out all those teeny particles.” Some micro particles may still be visible in the oil after straining, but they will settle once the oil is stored, and it is easy to prevent them from transferring into a pot the next time you want to use it.

Finally, Underwood suggests transferring the oil to a clean and dry container. “It’s very important that it doesn’t have any residual water in it,” she says, “and then just put a lid on it, tightly sealed, and keep it away from heat and light.” If you don’t plan to use it immediately, you can store it in the refrigerator, but any place with a consistent temperature and away from light works.

Considerations for reusing oil

There’s nothing special that needs doing in order to use preused oil the next time, but bear one thing in mind: “Just be aware that it would now carry allergens from anything that you previously cooked in it,” says Underwood, which is essential to know if you’re cooking for other people.

Since that can be hard to track over multiple uses, “Always label and date it,” she suggests. “I just put a piece of tape on it with the date and the number of uses. And I also actually put what was fried in it,” she says, which can help keep track of potential allergens.

It also helps keep potentially odd flavors out of whatever you cook next, as certain items like seafood or onion rings can impart flavor into the oil. “I don’t typically like to fry a savory thing and then fry a sweet thing,” says Underwood. “Like I wouldn’t make schnitzel and then use that oil for a donut.” 

If you’re unsure whether an oil is still good to use, let your nose guide you to suss out if something is funky. If you’re not confident in your sniffing ability, Underwood advises smelling unused oil of the same type first, then smelling the used oil for comparison. You can use frying oil at least two or three times, maybe more if it was only used for light-flavored things that didn’t impart many particles and was never overheated.

Read more: An Expert Explains When to Use Certain Cooking Oils

Benefits of reusing oil

The biggest benefit of reusing frying oil is the savings in every possible regard — you save money, and it’s a much more environmentally friendly practice across the board. “When you’re reusing any product, then you’re lowering the demand for things like production, packaging and transport,” Underwood says. “I don’t think that we think about that big picture very much, but if we were all reusing it, it would reduce those demands on the environment.”

Each time you reuse oil, it also diminishes in volume a bit. In my experience, at least with shallow frying, you can use the same batch of oil until, after a few uses, nothing remains to discard — the ultimate win.

Pamela Vachon

Contributor

Pamela is a freelance food and travel writer based in Astoria, Queens. While she writes about most things edible and potable (and accessories dedicated to those topics,) her real areas of expertise are cheese, chocolate, cooking and wine. She’s a culinary school grad, certified sommelier, former bartender and fine dining captain with 10 years in the industry. When not sitting at the keys, she leads in-home cheese classes, wine tastings and cocktail demonstrations.

See full bio

Advertisement

Jason Dessen cannot seem to get away from the Box, even when there isn’t one in front of him. In Dark Matter Season 2, Episode 4, Jason finishes a shift at the bar and, after stepping outside, reaches for the door to go back in. For a moment, it isn’t the entrance to the pub anymore. He sees himself opening the familiar door of the Box, with the corridor behind it, before reality settles back into place.

It is a brief moment, but an effective one, particularly after Episode 3 had Jason painstakingly dismantling the machine in the hope of finally putting some distance between his family and the multiverse. The physical Box can be taken apart; Jason’s relationship with it clearly cannot. More than that, seeing an ordinary rectangular doorway suddenly become its entrance makes us wonder about something Dark Matter has largely trained us to accept without question: why was the gateway to infinite realities a box in the first place? Why not a circle, a sphere, or the kind of glowing portal science fiction has taught us to associate with travelling somewhere impossible?

The answer begins much earlier than the Apple TV series.

The Box came before Blake Crouch knew what it did

When Blake Crouch was developing the 2016 novel on which the series is based, the shape wasn’t the conclusion to some elaborate piece of quantum theory. The image came first. “I had the image of a box in a warehouse, with a door on it. And that was it,” Crouch said of the idea that eventually became Dark Matter. He was brainstorming the novel in 2014, after spending years circling quantum mechanics and looking for the right story to connect to it.

A box creates an unmistakable boundary, which makes it a particularly useful object for a story built around lives that can branch into almost endless possibilities. Something is either inside it or outside it, and crossing that threshold becomes an event in itself. Crouch didn’t need the fictional physics to demand a cube; he needed an object that could make the act of entering another possibility feel physical.

The science behind the Box is fictional, but its basic idea grows out of a familiar quantum concept. Jason’s original research involved a much smaller cube intended to shield a tiny physical object from observation and external stimuli, keeping it in what he describes as an undetermined “cat state.” Jason2 succeeds where he did not and scales the concept until the experiment is large enough to contain a human being. The Box becomes the physical expression of an experiment built around observation, uncertainty and the possibility that more than one outcome can exist.

A hard-edged cube also gives the story something almost paradoxical to work with. Its dimensions are fixed, its walls are solid, and its boundary is obvious. Inside it, however, Dark Matter places a corridor that seems to have no meaningful end, with doors leading to realities that can differ wildly from the one left behind. The most ordinary-looking object in the story consequently becomes the entrance to something that cannot be contained by its physical dimensions.

Schrödinger’s cat makes the shape more interesting

The obvious reference is Schrödinger’s cat, the famous thought experiment in which a cat is sealed inside a box with a quantum event that can determine whether it lives or dies. Until the system is observed, the thought experiment imagines the cat occupying both possible states.

Dark Matter effectively puts the observer inside that experiment. Jason doesn’t stand outside the Box wondering which state exists on the other side. He enters it, becomes part of the experiment, and encounters a corridor through which different outcomes can be reached. The Box turns a thought experiment about mutually exclusive possibilities into the architecture of the series itself.

The visual contradiction is what makes the idea especially effective. A cube is rigid, finite and easily understood. It has fixed dimensions, hard corners and an obvious boundary between inside and outside. Dark Matter, meanwhile, places something apparently limitless within it. Once the drug takes effect, the enclosed space gives way to a corridor whose doors can lead to an extraordinary number of realities.

A circular portal would immediately communicate its purpose. Science fiction has spent decades teaching audiences that a glowing ring, tear or doorway is shorthand for travel between places that should not be connected. The Box carries a different suggestion. From the outside, it looks like an industrial object that could plausibly be sitting in an abandoned warehouse. Its strangeness only begins once the door closes.

Every door inside the Box also turns the mechanics of the multiverse into a question of choice. Jason can see other versions of his life, but seeing them does not make choosing between them easier. Each possibility carries its own consequences, and the person standing in the corridor still has to decide which one is worth entering.

Season 2 has changed what the Box represents

In Season 1, the Box was primarily a means of movement. Jason needed it because every journey through it offered another chance to find Daniela, Charlie and the world from which Jason2 had removed him. However frightening the realities behind its doors became, the machine still represented a possible route home.

In the current season, the relationship has become much less comfortable. Jason has his family again, yet the Box remains at the centre of their instability. His fixation with the machine is now affecting the life he fought to recover, and dismantling it becomes an attempt to impose some kind of final boundary between his family and the multiverse.

Episode 4 pushes that idea somewhere more personal. Jason no longer needs to be physically inside the Box for its presence to follow him. An ordinary doorway briefly becomes its entrance, turning something completely familiar into a reminder of the place he has spent so much of his life trying to escape. The image works because Jason’s problem is no longer simply the machine itself. He has begun to carry the Box with him.

The object can still function as a laboratory and a doorway, but its meaning has expanded. For Jason, it has also become a kind of prison, because destroying the physical machine cannot erase what happened inside it or the lives he has seen on the other side. A story about infinite possibilities has consequently given its central character a strangely finite problem: he cannot simply choose a different reality and leave the consequences behind.

Crouch may have started with nothing more complicated than the image of a mysterious box in a warehouse, but Dark Matter has spent two seasons turning that simple shape into the physical language of its entire story. It contains the experiment, separates Jason from the world he knows, opens onto lives that should never have been accessible, and now follows him even when he isn’t anywhere near the machine. The Box was always about crossing a boundary, but Jason’s experience suggests that some boundaries become much harder to cross back over.

The latest episode makes the idea particularly clear. Jason can dismantle the machine and try to build a life outside it, but the Box has become part of how he sees the world. For a character who spent so long trying to find the right door, the more unsettling possibility may be that he can no longer look at an ordinary one without wondering where it might lead.

An ongoing npm malware campaign involving the ‘indexed-btree’ package shows how threat actors bypass supply chain defenses by hiding malicious code in a package’s normal runtime behavior rather than in installation scripts.

The package, spotted by Checkmarx researchers, attempts to impersonate the legitimate ‘sorted-btree’ library and has already amassed 2 million weekly downloads.

The campaign may also have generated significant profits for the attackers, who, according to Checkmarx, use a wallet holding 109 ETH. However, the report does not say those funds came from cryptocurrency theft.

Bypassing latest security measures

In June 2026, GitHub announced a set of npm security measures designed to help prevent supply chain attacks that have shaken open-source ecosystems repeatedly since late 2025.

One key security measure is to block dependency lifecycle scripts such as ‘preinstall’, ‘install ‘, and ‘postinstall,’ unless explicitly approved.

Other measures prevent npm from automatically retrieving dependencies from Git repositories or remote URLs without permission.

The malicious indexed-btree package sidesteps these protections by avoiding installation scripts and instead hiding its loader in the package’s BTree.prototype.set() method, which executes at runtime when the application calls it with a specific key value.

As a result, installation appears clean and triggers none of npm v12’s approval mechanisms.

“The malware loader hides inside the library’s own BTree.prototype.set method, which is the main function that every user would call constantly,” explains Checkmarx.

“This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners.”

Once the malware is executed, it can collect system details, including architecture, hostname, CPU, memory, and uptime, and exfiltrate the information through hardcoded Slack and Telegram channels.

The malware also polls an Ethereum smart contract on the Sepolia test network for command-and-control (C2) information. It uses X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract.

When the operators choose to end the attack, the malware can delete its files and remove the malicious trigger from the package code to wipe its traces.

The researchers note that the threat actors have gone to great lengths to make the project appear legitimate, including building a legitimate-looking GitHub repository, populating its commit history, and curating the developer account.

Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm. Those also achieved significant download numbers, as seen here:

1. ordered-kv-index (448,184 downloads)
2. btree-leaderboard (493,685 downloads)
3. priority-slot-queue (402,860 downloads)
4. btree-range-store (468,092 downloads)
5. btree-core (1,951,274 downloads)
6. btree-time-index (425,312 downloads)
7. btree-lru-cache (372,185 downloads)
8. neighbor-key-map (366,019 downloads)
9. sliding-score-window (448,024 downloads)

Developers are advised not to rely on install-time scanning alone, and to also employ runtime behavioral analysis.

Those who installed indexed-btree or any of the above-listed packages should rotate all secrets and restore their development environment from a safe backup.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Pavlo Bazilinskyy still can’t believe he was on PornHub for work. He’s an assistant professor at the Eindhoven University of Technology in the Netherlands, and has spent more than a decade researching AI-driven interactions between humans and robots. But he found himself typing “public transport” into the search bar of a very specific website’s “amateur section.” 297 hits.

“People are hard to predict,” Bazilinskyy says. It’s why he researches what he does. So his prurient pursuit had a point. Robotaxis without cabbies behind the wheel have started picking up passengers in a handful of countries, including the US. Meanwhile, there’s a long history of people getting up to antisocial behavior inside the quasi-private or straight-up public spaces of trains, planes, and automobiles—think the prom night limo, the “Mile High Club,” Tom Cruise in slow motion aboard the Chicago L in Risky Business, the stuff he found on PornHub.

What might riders do when there’s no authority figure inside a vehicle to say, “Hey, stop that!”? What do they do? Can people be convinced to stop before they start?

This week, Bazilinskyy and academic colleagues with backgrounds in systems engineering, computer science, psychology, and tourism studies are hosting an industry workshop asking participants to brainstorm along those very lines: How do you stop people from doing it in self-driving cars? Thinking about sex in autonomous vehicles, they theorize, can let anyone who cares about the future of mobility “stress-test” the role the vehicles might eventually play as communal spaces, where social norms get acted out every day.

The event focuses on prevention not just because these academics are no fun (though Alexandros Rouchitsas, an engineering psychologist who is also hosting the event, admits they are “taking the side of the parents, the elderly—we are not the cool people here”). They don’t want people to have sex in self-driving cars because they’re worried it will give a potentially positive technology a really bad rep.

“We want to see automated mobility solutions accepted, trusted by the general public,” Rouchitsas says. Self-driving could have huge upsides for the elderly, children, and people with disabilities, who have a harder time getting around places where driving is quicker and sometimes necessary. The tech might eventually move beyond private taxis and into public transit, where all sorts of people should be able to travel safely and comfortably. “We want automated mobility solutions to be seen as something that is equitable, serious, societally minded,” he says.

Rouchitsas’ biggest fear is that self-driving gets co-opted by the partiers, the drug users, the sort of hedonistic folk who have descended on some islands of his native Greece. “You know ‘Bang Bus’?” he says. “We don’t want that.”

The four-hour workshop—rise and shine, it starts at 8:30 am—is part of an industry conference in Gothenburg, Sweden, focusing on how people interact with vehicles and larger mobility systems. The organizers expect participants from academia but also the wider industry. (Gothenburg is home to Volvo Cars and the tech supplier SmartEye; BMW and Google are conference sponsors.) Those who show up will be prompted to come up with physical and design interventions that encourage people to not do that. The workshop will focus on preventing consensual interactions, its organizers say.

Rouchitsas, who studies human-machine interactions, says he hopes participants will get creative with their anti-action designs. But just off the top of his head: Maybe the vehicles could be transparent? Maybe a light begins to blink if the technology senses behavior it disapproves of? The organizers intend to publish a paper based on the workshop’s results.

Sex is the fun, eye-catching part here, made all the more alluring because it’s “the elephant in the room” for those thinking about how humans might interact with machines in the future, says Bazilinskyy—very under-studied. But the results of this sort of inquiry could help designers, companies, and lawmakers figure out how to compel people to safely share communal spaces like public self-driving buses in the future.

Prevent sex and maybe you’ll also prevent robbery, bullying, and homicide. “It could be helpful for the industry and academics to use this example to design other things,” he says.

There’s a frightening new digital threat that Android users should be aware of. New AI-powered malware called RatHat can automatically gain admin-level control over your Android device, stealing whatever it wants.

RatHat was discovered by mobile security firm Zimperium, which notes that the program tricks people into downloading what appears to be a legitimate app, such as Google Chrome, via a fake web page that mimics the Google Play Store. Once opened, the app seemingly innocently asks for accessibility permissions, which it then uses to take over your entire device. 

RatHat uses the accessibility permissions users grant it to navigate your phone’s menu system and unlock Wireless Debugging, a legitimate developer tool commonly used in app testing, then grants itself ADB Shell permissions. This effectively grants the malware admin access to your device. Next, RatHat installs an AI-assisted agent that runs system commands to steal information and a proxy client that tunnels that stolen information back to the hacker. 

“That sort of infection chain isn’t necessarily more complex than, say, following a phishing email on Windows and saying yes when the program asks for administrator permissions,” Sav Wheeler, a research engineer for Malwarebytes, said in an email. “Escalation in the Android landscape often relies on granting apps additional permissions that the OS locks away by default to keep the devices secure.”

Per Zimperium, the malware can be traced to attackers in China and primarily targets apps like WeChat Pay and Alipay, which are as popular in China as Apple Pay and Venmo are in the US. Malwarebytes notes that other financial apps can also be targeted. So far, researchers have found 162 infected apps in the wild, which report back to a dozen servers run by attackers. 

What can this malware do?

The worrisome part is that the malware doesn’t do anything wonky the user would notice immediately, unlike with a ransomware attack. Instead, it bides its time, runs in the background, and captures information that appears on the screen, including usernames, passwords and two-factor authentication codes. 

It can also steal raw touch input from your touchscreen, allowing it to recreate PIN codes and pattern unlock codes. It can capture SMS messages, too, thereby intercepting security codes. There isn’t much that the app can’t steal if it wants to.

How can I find out if I have RatHat on my phone?

The only way to find it is to run an antivirus scan that detects the software. Malwarebytes is a free option on Google Play that can do this. Wheeler told CNET that it can detect the malware pretty easily, which is good news for anyone who’s worried about whether or not they have it. 

The bad news is that RatHat is sneaky and difficult to quarantine. 

“Unfortunately, because of the behavior of the program itself — remasquerading as other apps, dynamically changing its behavior using the AI endpoint — static analysis and quarantining is not enough to remove the malware,” Wheeler said. 

In short, the only way to actually get rid of this malware is a complete factory reset of your device. This effectively removes the hidden secondary files the malware installs, which antivirus apps can’t deal with. Uninstalling the app doesn’t work because the malware retains its admin access through those hidden files, which then let it reinstall the app over and over again. 

How do I avoid RatHat?

This is also good news. RatHat’s infection method is complex and can be thwarted at multiple points during the process. First, you should never click a link from an SMS or email from a source you don’t know or trust. That stops almost all social engineering threats right out of the gate, including RatHat. Verify that you’re using the official Google Play app rather than a deceptive imitation website. Look at the top of the screen. If it has an address bar where you type URLs, it’s just a website disguised as an app. Real apps do not have address bars.

Also, note that preinstalled or existing versions of Chrome do not require reinstallation, so if you’re being asked to reinstall an app you know you have, think twice.

Denying accessibility permissions is the critical final line of defense against mobile malware. While downloading a malicious application is risky, the software remains largely powerless until you grant it advanced system privileges.

Wheeler says that SMS phishing is targeted to each specific user, so you won’t see the same phishing attempt as another person, and the tactics the app uses vary from region to region. Following standard antiphishing practices and not enabling accessibility permissions largely removes the threat of RatHat. 

Joe is a freelance journalist. It all started with a long-running affection for building his own PCs, which he did for the first time as a teenager. It evolved into a lifelong enjoyment of putting words on the internet about the subject. He’s written for CNET, PCMag, Mashable and SlashGear as a freelance writer, and worked as a Senior Editor at Android Authority for 10 years. When he’s not writing about tech and science, he’s learning the ins and outs of DIY home repair, gaming, playing his bass guitars and posting help on PC building and gaming subreddits. He is a staunch believer that orange juice should have pulp.

See full bio

Advertisement

A £249.01 discount on a full SteamOS handheld is the kind of deal you usually only hear about after it’s already gone.

Catch this one while it’s still live: Lenovo has cut the Legion Go Steam Handheld Gaming Console to £399.99 as part of its EE Game Day offers this September, down from £649, a straight saving of £249.01, or roughly 38 percent off.