AllYouCanTech

Facebook and Nvidia Call on Supreme Court to Limit “Nuisance” Investor Lawsuits in Wake of Corporate Scandals

# Facebook and Nvidia Request SCOTUS to Limit Investor Lawsuits

Two prominent technology firms, Facebook (now Meta) and Nvidia, are appealing to the United States Supreme Court (SCOTUS) in disputes that could alter the legal terrain for investor lawsuits. Both entities are urging SCOTUS to constrict the legal avenues through which investors can pursue claims against them for losses resulting from alleged corporate wrongdoing. The decisions made in these cases could significantly influence how technology firms disclose risks and manage investor relations following controversies.

### Overview of the Cases

The two matters currently before the Supreme Court involve significant scandals that have shaken the tech sector in recent years:

1. **Facebook-Cambridge Analytica Scandal**: This case centers on Facebook’s management of the notorious Cambridge Analytica data breach, where the personal information of millions of users was inappropriately accessed and utilized for political marketing. In 2019, Facebook reached a settlement with the Federal Trade Commission (FTC) and the Securities and Exchange Commission (SEC), paying over $5 billion in civil fines for misleading users and investors regarding the breach. Nonetheless, investors have continued to pursue legal action, contending that Facebook deceived them by failing to disclose the breach promptly and transparently.

2. **Nvidia’s Cryptocurrency Surge**: Nvidia is confronting allegations that it misrepresented the actual source of its revenue growth during the 2017–2018 cryptocurrency surge. Investors assert that Nvidia minimized the degree to which its sales were propelled by the volatile cryptocurrency market, as opposed to its primary gaming division. When the crypto market collapsed, Nvidia found it necessary to reduce its earnings forecasts, resulting in substantial investor losses. Nvidia settled with the SEC in 2022, incurring a $5.5 million penalty for insufficient disclosures, yet investors are still pursuing reparation through the litigation process.

### Legal Contentions

Both Facebook and Nvidia have filed appeals to SCOTUS, positing that the legal criteria for investor lawsuits must be tightened to fend off frivolous litigation. They argue that the existing legal framework enables investors to engage in “fishing expeditions” and initiate lawsuits based on hindsight instead of concrete evidence of fraud.

#### Facebook’s Stance: Hypothetical Risk Declaration

In the Facebook matter, the company defends its choice to characterize the risk of a data breach as a hypothetical occurrence in its SEC filings, even though the Cambridge Analytica breach was already in progress. Facebook’s disclosure articulated that a failure to avert or mitigate a data breach “could harm our business and reputation.” Investors contend that this phrasing was misleading because it suggested that no breach had occurred, while the Cambridge Analytica debacle was already happening.

Facebook argues that no reasonable investor would interpret a forward-looking risk disclosure as suggesting that no breach had ever taken place. The company claims that mandating it to report every past material incident would establish an “omissions liability” regime, compelling companies to over-disclose information and potentially inundating investors with extraneous data.

#### Nvidia’s Position: Expert Testimony and Crypto Revenue

In the Nvidia case, the company disputes the use of expert testimony to estimate how much of its revenue was linked to cryptocurrency demand. Investors relied on such an expert analysis to assert that Nvidia underreported its crypto-related revenue by over $1 billion. Nvidia contends that this expert testimony is speculative and that the lawsuit represents an instance of “fraud by hindsight,” where investors are initiating claims based on market conditions that were unforeseeable at the time.

Nvidia is invoking the Private Securities Litigation Reform Act (PSLRA), which imposes stricter pleading requirements on plaintiffs in securities fraud cases. The company argues that the 9th Circuit Court of Appeals erred in permitting the lawsuit to advance based on expert testimony, which Nvidia claims was “manufactured” to align with the investors’ allegations.

### Possible Consequences

The Supreme Court’s rulings in these cases could have extensive implications for both tech companies and investors. If SCOTUS favors Facebook and Nvidia, it may become considerably more difficult for investors to litigate against companies for securities fraud, especially in situations involving intricate disclosures and emerging markets like cryptocurrency.

#### Effects on Investor Lawsuits

Both Facebook and Nvidia caution that upholding the 9th Circuit’s decisions could unleash a deluge of frivolous lawsuits. Nvidia, in particular, has asserted that permitting expert testimony to serve as the foundation for securities fraud claims would create a “dangerous” precedent, facilitating investors to launch lawsuits based on speculative data.

Conversely, investors contend that private securities litigation is a crucial mechanism for ensuring corporate accountability. They argue that if SCOTUS favors the tech giants, it would effectively grant companies a “license to intentionally mislead investors” by minimizing or omitting material risks in their disclosures.

#### Pro-Business Court?

Legal analysts have noted that the Supreme Court’s conservative majority has a history of delivering business-friendly decisions, especially in matters related to federal regulation. Andrew Feller, a former SEC

Pharmaceutical Firm Shut Down Following Discovery of Contaminants in Injectable Weight Reduction Drug

# FDA Raises Alarm Over Compounded Weight-Loss Medications Amid Ongoing Legal Disputes

The U.S. Food and Drug Administration (FDA) has issued a significant alert to both consumers and healthcare providers concerning the products made by Fullerton Wellness LLC, a compounding pharmacy located in Ontario, California. This notification emerges as the FDA continues to deal with safety issues related to compounded weight-loss medications, a sector that has surged recently due to the rising demand for drugs such as Wegovy, Ozempic, and Mounjaro.

## The FDA’s Notification

The FDA’s advisory was triggered by a concerning finding: Fullerton Wellness was producing drugs that must be sterile—namely injectable medications—without adhering to appropriate sterilization protocols. Among the drugs manufactured by the pharmacy were semaglutide and tirzepatide, which are designed to replicate established weight-loss and diabetes therapies like Wegovy, Ozempic, Zepbound, and Mounjaro.

The problem surfaced after a patient reported discovering a “black particulate” within a vial of semaglutide, which is an injectable medication that requires sterility to prevent severe health hazards. Following a thorough investigation, the FDA determined that Fullerton Wellness was utilizing non-sterile components in these injectable drugs and had failed to implement any sterilization measures.

Administering non-sterile medications can result in serious and potentially fatal health issues, including infections and sepsis. Consequently, the FDA has recommended that medical offices, clinics, and patients immediately discontinue the use of any products from Fullerton Wellness and isolate any leftover items.

## Fullerton Wellness Shuts Down

After the FDA’s inquiry, Fullerton Wellness voluntarily halted its operations. An inspection conducted at the pharmacy’s facilities in October verified that the company had been using non-sterile ingredients in its injectable medications. Nonetheless, it remains uncertain how extensively Fullerton Wellness’s drugs were distributed, and the company has not provided any comments regarding the situation.

## The Increasing Appeal of Compounded Weight-Loss Medications

The FDA’s warning is merely the latest incident in a broader conflict over compounded weight-loss medications. These drugs are essentially generic versions of well-known treatments like Wegovy, Ozempic, Zepbound, and Mounjaro. Compounding pharmacies are permitted to create these products only when the original branded versions are in limited supply, acting as a temporary measure to ensure patient availability.

However, given the soaring demand for weight-loss treatments and the exorbitant prices of their branded counterparts, compounded alternatives have become a desirable and cost-effective option for numerous patients. This trend has resulted in a surge in compounded weight-loss medications, consequently raising alarms regarding their safety and quality.

## Legal Conflicts and Industry Strains

The emergence of compounded weight-loss drugs has ignited a legal showdown between major pharmaceutical corporations and compounding pharmacies. Leading drug companies such as Eli Lilly, the producer of Zepbound and Mounjaro, and Novo Nordisk, the manufacturer of Wegovy and Ozempic, have initiated lawsuits against compounding pharmacies, alleging that they are creating unsafe and deceptive versions of their medications.

In one prominent instance, Eli Lilly took legal action against several compounding pharmacies for their production of knockoff types of tirzepatide, the active component in Zepbound and Mounjaro. Novo Nordisk has also pursued legal avenues, asserting that semaglutide, the active ingredient in Wegovy and Ozempic, is too intricate for compounding pharmacies to effectively duplicate.

The FDA has also found itself in a contentious position. In October, a trade group representing large-scale compounding pharmacies filed a lawsuit against the FDA after the agency removed tirzepatide from its drug shortage list. This action effectively prohibited compounding pharmacies from creating generic versions of the medication. Nevertheless, the FDA swiftly rescinded its decision in court, permitting compounders to persist in producing alternative versions of tirzepatide while reconsidering the withdrawal.

## The Outlook for Compounded Weight-Loss Medications

As the litigation continues, the future of compounded weight-loss medications remains ambiguous. In October, Novo Nordisk formally sought that the FDA prohibit compounding pharmacies from manufacturing generic versions of semaglutide, citing safety apprehensions. The company contended that the drug’s intricacy complicates safe replication by compounders, resulting in notable risks for patients.

In reaction, the Outsourcing Facilities Association, a trade organization representing compounding pharmacies, sent a letter to the FDA requesting that the agency obligate Novo Nordisk to submit an economic impact assessment. The organization argued that eliminating semaglutide from the compounding landscape could cause considerable price hikes and restrict patient access to affordable options.

## Conclusion

The FDA’s alert regarding Fullerton Wellness underscores the persistent challenges in monitoring the expanding market for compounded weight-loss medications. As the appetite for these drugs continues to escalate, so too do the worries surrounding their safety, quality, and legality. With pharmaceutical

“Malicious Code Repositories aimed at Hundreds of JavaScript Developers”

# Continuous NPM Supply Chain Assault: Harmful Packages Aim at Developers

In a troubling update for the software development sector, a sustained attack has been discovered that involves the introduction of numerous harmful packages to the open-source Node Package Manager (NPM) repository. These packages are intended to compromise the devices of developers who depend on widely-used code libraries. The ongoing attack was recently highlighted by the security firm Phylum and underscores the escalating risk of supply chain assaults within the software environment.

## The Assault: Typosquatting and Harmful Packages

The perpetrators are employing a strategy known as **typosquatting**, where harmful packages are named similarly to legitimate ones to deceive developers into downloading them. Specifically, these malicious packages imitate popular libraries such as [Puppeteer](https://www.npmjs.com/package/puppeteer) and [Bignum.js](https://www.npmjs.com/package/bignum.js), as well as various libraries associated with cryptocurrency development.

Typosquatting has historically been a method used to attract unwitting users to harmful websites. However, over the last five years, this strategy has increasingly been utilized to mislead developers into installing malicious code libraries. In this instance, the harmful packages aim to infect the developer’s system and could jeopardize the security of their projects.

## Supply Chain Assaults: A Rising Concern

Supply chain assaults, where attackers focus on the software supply chain by infiltrating third-party components, have emerged as a noteworthy issue in recent years. Phylum researchers accentuated the ongoing nature of these attacks, remarking:

> “Out of necessity, malware authors have had to endeavor to find more novel ways to hide intent and to obfuscate remote servers under their control. This is, once again, a persistent reminder that supply chain attacks are alive and well.”

The harmful packages in this initiative utilize a fresh approach to mask the IP addresses of the servers they connect with to gain second-stage malware payloads. Rather than hardcoding the IP address in the first-stage code, the attackers leverage an Ethereum smart contract to dynamically fetch the IP address.

## How the Attack Operates

When a developer installs one of the malicious packages, the code taps into an Ethereum smart contract to obtain a string containing the IP address of the server responsible for delivering the second-stage malware. This technique allows the attackers to sidestep directly embedding the IP address in the code, thereby making it more challenging to detect the malicious operations.

Interestingly, while this technique was likely designed to obscure the source of the second-stage infections, it inadvertently created a record of previous IP addresses utilized by the attackers. The Ethereum blockchain retains an immutable history of all values related to a contract, enabling researchers to trace the past IP addresses employed.

Phylum researchers successfully identified multiple IP addresses used by the attackers, including:

– **hxxp://localhost:3001** (2024-09-23)
– **hxxp://45.125.67[.]172:1228** (2024-09-24)
– **hxxp://45.125.67[.]172:1337** (2024-10-21)
– **hxxp://193.233[.]201.21:3001** (2024-10-22)
– **hxxp://194.53.54[.]188:3001** (2024-10-26)

## The Malicious Payload

Upon installation, the harmful packages manifest as a packed [Vercel](https://en.wikipedia.org/wiki/Vercel) package. The payload operates in memory, configures itself to load with each reboot, and connects to the IP address obtained from the Ethereum smart contract. Following this, it executes several actions, including:

– Retrieving additional JavaScript files from the malicious server.
– Transmitting system information back to the server, encompassing details about the GPU, CPU, memory, username, and operating system version.

This information could be leveraged by attackers to further breach the system or to customize future attacks according to the specific hardware and software setup of the compromised machine.

## Safeguarding Yourself: Recommended Practices for Developers

To prevent becoming a victim of this attack type, developers should implement the following measures:

1. **Verify package names:** Typosquatting exploits minute differences in package names, such as misspellings or extra symbols. Always confirm the name of a package before downloading it, particularly if it is a new or unfamiliar library.

2. **Utilize reliable sources:** Whenever feasible, obtain packages from official repositories or trusted sources. Exercise caution when utilizing third-party libraries that are not well-established or widely recognized.

3. **Keep an eye on dependencies:** Regularly scrutinize your project’s dependencies to ensure that no harmful or compromised packages have been introduced. Tools like