gradle wrapper attack
Recently, an anonymous hacker hacked a Minecraft server called Minecraft Online by compiling a malicious Gradle Wrapper JAR file. This malicious gradle wrapper file was then able to gain access to the server furthermore when the gradle security team decompiled the JAR files, they discovered that two exploits were patched into the wrapper file
1. discord credential stealer
The first exploit found in the code was a discord credential stealer.
one way the file could attempt to steal discord passwords is by searching through files on the host computer.
This code would hide in different gradle classes and obfuscate string constants using a method called a character array lookup. The gathered credentials were then sent to a discord bot using a token in the code.
2. downloading and running code on the host device
In the code the gradle team also found code that could download
programs on the host computer this could be used to cause popup bombs or download malware or spyware such as pegasus furthermore, this can be used to edit the build.gradle file and modify the software being built by dependencies, and edit the projects specific source file so that the software would execute the malicious code.