Packagist Postinstall Malware: What Developers Should Check
A Packagist and GitHub supply-chain campaign used malicious postinstall hooks to fetch…
GitHub Internal Repos Exposed Through Poisoned VS Code Extension
GitHub says an employee device was compromised through a poisoned VS Code…
Shai-Hulud AntV npm Supply-Chain Wave: What Developers Should Check
Shai-Hulud returned in an AntV npm supply-chain wave affecting hundreds of packages.…
Mini Shai-Hulud Hits TanStack npm Packages With Signed Malware
Mini Shai-Hulud abused trusted publishing to ship malicious TanStack npm packages with…
Checkmarx Jenkins Plugin Compromise Put CI Secrets at Risk
A rogue Checkmarx AST Scanner Jenkins plugin release put CI/CD source code…
Operation HookedWing Phishing Hit 500+ Organizations
Operation HookedWing used GitHub Pages, compromised servers, and staged redirects to target…
SmartLoader, LummaStealer Abuse Fake GitHub Repositories
A new campaign has been discovered where malicious actors are leveraging AI…
GitHub Enterprise Server Auth Bypass Flaw Discovered
On May 21, 2024 GitHub disclosed a new authentication bypass flaw in…
GitHub and GitLab CDNs Abused to Spread Malware
Recent research around new spreading approaches of one stealer malware family revealed…
STRRAT and Vcurms Malware Abuse GitHub for Spreading
A new phishing campaign has recently been discovered that uses GitHub to…
RepoJacking Attacks Could Threaten Millions of GitHub Repositories
Aqua researchers believe that millions of repositories on GitHub are vulnerable to…
Malware in GitHub Repositories Is Spread From Fake Security Company Name
Researchers detected fake company accounts on GitHub linked to a deceitful cybersecurity…