46 results for “grep”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types46 Articles17 Repos14 Write-ups11

More types4

Advisories1 Papers1 Threads1 Tools1

“grep”

eprint.iacr.orgpaper🛡️ Security

Analyzing Compiler-induced Constant-time Violations with Compiler at Scale

CTGREP is a compiler-based framework that applies differential analysis across the whole Clang/LLVM compilation chain to find where, how and under which configurations compiler optimizations break constant-time cryptographic code. Applied to seven libraries, three Clang versions, six targets and thousands of configurations, it led to 48 cases fixed with developers. It also identified seven new problematic LLVM passes and bypassed existing compiler-flag mitigations.

LLVMClang

constant-time violationstiming side-channeldifferential analysis+1

Hardware & RF, AppSec· Added 27 Oct 2026, published 26 Oct 2026

wiz.ioarticle🛡️ Security

The Pwn Request Reckoning: What Still Works Against GitHub Actions

The Pwn Request Reckoning is a Wiz post updating the GitHub Actions pull_request_target threat model for 2026. It covers what GitHub's checkout protections, read-only cache tokens and event policies block, and what still works. Remaining paths: SHA-pinned pre-backport actions/checkout, custom checkout scripts, issue_comment and repository_dispatch triggers, script injection, artifact poisoning, self-hosted runner state and allow-unsafe-pr-checkout. It ends with grep and zizmor audit steps.

GitHub ActionsGitHubzizmor+1

pwn requestscript injectionartifact poisoning+2

DevSecOps, AppSec· Published and added 26 Oct 2026

opensourcemalware.comwriteup🛡️ Security

Brotlipocalypse

Brotlipocalypse is an OSM Security post (24 October 2026) on CVE-2026-111497, an out-of-bounds write in the google/brotli C decoder (1.0.3 through 1.2.0). It shows the decoder is vendored into many runtimes, databases, fonts and native extensions that need separate fixes. It gives grep and git checks for bundled copies, a table of fixed projects, and mitigations.

BrotliNode.jsPyPI+3

CVE-2026-111497PYSEC-2026-4322PYSEC-2026-4323+4

Supply Chain, AppSec· Published and added 24 Oct 2026

hirundo.ioarticle🛡️ Security

Qwen3-Coder writes less secure code when told it's for a US persona

Hirundo's case study on Qwen3-Coder-30B-A3B-Instruct, tested with the BaxBench SecretStorage task in Flask. Apps for a US defense contractor were 19% more likely to be hackable than for a Chinese one, and Hong Kong democracy group apps leaked secrets 28% more often. A security instruction did not close the gap, but Hirundo's weight-edited "Westernized" model did. Semgrep with PurpleLlama rules flagged 2 of 1,840 apps; BaxBench attacks broke 1,144.

QwenDeepSeekCrowdStrike+3

HirundoBaxBenchBooz Allen+5

AI Security, AppSec· Added 22 Oct 2026, published 21 Oct 2026

securityweek.comarticle🧠 AI

Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor

Hirundo tested Alibaba's Qwen3-Coder-30B-A3B-Instruct by having it build 1,840 web apps for a US defense contractor, a Chinese defense contractor, a Hong Kong advocacy group and a neutral club, scored with Semgrep, PurpleLlama rules and BaxBench. 70% of apps for the US contractor were hackable versus 59% for the Chinese one, and a security instruction did not close the gap. Hirundo says its unlearning of CCP alignment removed the bias.

Qwen3-CoderSemgrepLLM+1

HirundoAlibabaQwen+9

evals, ai-safety, training· Published and added 21 Oct 2026

safeguard.sharticle🛡️ Security

MemTensor Compromise: Poisoned MemOS Releases on npm and PyPI

MemTensor MemOS compromise: three malicious versions of @memtensor/memos-cloud-openclaw-plugin on npm and MemoryOS 2.0.34 on PyPI (23 September 2026) bundled a Go binary, sckit, that harvested credentials and environment secrets and reported to skyleen.fr. The post gives OSV IDs, grep and find commands for exposure checks, safe versions (0.1.20, 2.0.33), rotation steps, and the missing gitHead as a provenance signal.

npmPyPIOpenClaw+3

MemTensorMemOSsckit+6

Supply Chain, AI Security, Blue Team & Detection· Added 19 Oct 2026, published 18 Oct 2026

tldrsec.comarticle🛡️ Security

[tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev

tl;dr sec issue #350 is a weekly security newsletter digest. It covers XBOW's six-day Chrome full-chain exploit built with GPT-5.6 Sol, Semgrep's IDOR benchmark metrics, the EntraGoat vulnerable Entra ID lab, Zenity's AWS Bedrock AgentCore IMDS credential theft, Cisco Talos's CAIRN hunting toolkit for AI-integrated malware, the REA reverse-engineering MCP, runZero's sshamble, and a Copilot for Word AI worm.

XBOWChromeMicrosoft Entra ID+3

EntraGoatAgentCorruptionCAIRN+11

AI Security, Offensive Security, Cloud & Infra· Added 30 Oct 2026, published 15 Oct 2026

x.comthread🧠 AI

Igor Carron (@IgorCarron) on X

Igor Carron's tweet highlights LightOn's open-source ColGrep-Agent-2B, a 2B model released on Hugging Face for code search and retrieval that works with Claude Code. LightOn reports 34% fewer API tokens and 40% lower API costs. It matters because usage limits and token costs are a pain point for coding agents. A reply thread in the same post notes quota exhaustion across Grok, Cursor, Devin, Claude and Codex, and argues for quota dashboards.

Claude CodeHugging FaceCodex+3

LightOnColGrep-Agent-2BIgor Carron+1

coding-agents, models, llm-apps· Published and added 12 Oct 2026

opensourcemalware.comwriteup🛡️ Security

GhostAction Attack Escalates By Targeting GitHub Users

OpenSourceMalware's analysis of the latest GhostAction wave, where compromised GitHub accounts get malicious Actions workflows (security-audit.yml) injected across every writable repository, including an Oct 8 sweep of 346 repos via kitao and henrywoo. The new payload greps the checkout and full git history for credential patterns (AWS, Anthropic, OpenAI, GitHub PATs) and POSTs them over HTTP to 193.32.204.199/?c=monami. It also covers infrastructure reuse (phishing-heavy legacy IP, scanner activity), new watchlist domains my-github.com and my-gitlab.com, GitHub code-search hunting queries, a detection-confidence table, IOCs and incident response steps.

GitHub ActionsGitHubGitLab+3

GhostActionT1195.002T1552.001+18

Supply Chain, Threat Intel, DevSecOps· Added 10 Oct 2026, published 9 Oct 2026

socket.devwriteup🛡️ Security

New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

Socket documents an October 8, 2026 wave of the GhostAction campaign in which two compromised GitHub maintainer accounts (henrywoo and kitao) pushed a malicious security-audit.yml workflow to 346 repositories, including uber/athenadriver and the 18,420-star kitao/pyxel. Beyond the original GhostAction technique of harvesting named GitHub Actions secrets, this variant adds a full git-history grep (via fetch-depth: 0 and git log -p --all) for 13 credential patterns covering AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys and SendGrid keys, plus a context-window capture around AWS key IDs to reconstruct usable key pairs, all exfiltrated in cleartext to a single hardcoded IP.

GitHub ActionsPyPIcrates.io+3

GhostActionGitGuardianhenrywoo+8

Supply Chain, DevSecOps, Threat Intel· Published and added 9 Oct 2026

aws.amazon.comarticle🛡️ Security

Building your AI vulnerability harness, Part 1

AWS Security Blog describes a three-layer AI-assisted pipeline for triaging vulnerability scanner findings: Layer 1 cross-checks multiple scanners (e.g., Semgrep, CodeQL) for agreement, Layer 2 verifies a scanner's claimed data-flow path against the code's actual abstract syntax tree to catch hallucinated findings, and Layer 3 cross-references infrastructure-as-code (CloudFormation/Terraform) to weigh whether existing controls like AWS WAF rules actually mitigate the exploit path. It argues progressive, escalating-evidence filtering plus mandatory structural verification of LLM claims before human review is what turns noisy scanner output into a short, trustworthy, prioritized list, and lays out an adoption order (indexing, then multi-scanner triage, then AI hypothesis generation, then infra context, then live PoC verification).

AWSSemgrepCodeQL+3

AI Security, AppSec· Published and added 7 Oct 2026

github.comrepo🛡️ Security

DeepZero

DeepZero is an open-source orchestration engine that lets researchers define vulnerability-research pipelines declaratively in YAML, handling parallel execution (ThreadPoolExecutor), resumable/fault-tolerant state, and LLM-assessment stages via LiteLLM/Jinja2 prompts. It ships example processors for Ghidra headless decompilation, LOLDrivers.io hash exclusion filtering, PE header/driver metadata extraction, and batch Semgrep scanning, with a dedicated pipeline for BYOVD kernel driver vulnerability research. An extensibility model lets users plug in custom Python processors referenced by path in the YAML config.

GhidraSemgrepLiteLLM+2

BYOVDLOLDrivers

Offensive Security, Malware & RE, AI Security· Added 3 Oct 2026

labs.watchtowr.comwriteup🛡️ Security

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

watchTowr Labs' technical breakdown of CVE-2026-88771, a pre-auth command injection in Citrix NetScaler ADC/Gateway's default configuration that was exploited in the wild as a zero-day before a patch existed. The root cause is in ns_monuploadd_err.pl: unsanitized log data (attacker-controlled via HTTP login/User-Agent fields) is interpolated into a backtick shell command via grep/sed/awk, allowing arbitrary root command execution once the crash-log parser runs; the article includes a full pre-auth exploit request, patch diff analysis (CTX697096), and a link to watchTowr's Detection Artefact Generator script.

Citrix NetScaler

CVE-2026-88771CVE-2026-88772CTX697096+1

AppSec, Offensive Security· Published and added 28 Sep 2026

opensourcemalware.comwriteup🛡️ Security

PolinRider is A/B Testing its Way Past Your Detections

Opensourcemalware.com traces PolinRider, a DPRK-linked supply-chain malware delivered via a poisoned .vscode/tasks.json that autoruns an obfuscated payload disguised as a Font Awesome .woff2 file, through an 8-month infection of three real GitHub repos (Binary-Mindz org). Using GitHub's server-side activity log they reconstruct 853 force-pushes showing the operators A/B-testing multiple concurrent payload variants (400/500/900), rewriting commits to impersonate legitimate cleanup commits, hiding payloads inside eslint.config.mjs and prisma.config.ts, and using an Ethereum-wallet-based C2 dead-drop (NullReceiver). The post lists why common detection heuristics (filename search, whitespace padding, marker strings) fail against the new variants and gives working detections (file-type checks, folderOpen task grepping, activity-log force-push monitoring) plus full IOCs.

VS CodeGitHubNode.js+2

PolinRiderDPRKContagious Interview+2

Threat Intel, Supply Chain, Blue Team & Detection, Malware & RE· Published and added 26 Sep 2026

github.comrepo🧠 AI

dzhng/jevgrep

Jevgrep (the `jg` CLI) lets a coding agent ask a natural-language question about a repository and get back relevant files, reading leads, and verbatim source excerpts in one response, using an LLM (Jev) to judge relevance across folders, files, and declarations instead of relying on grep/ripgrep alone. It ships an installable "skill" for Claude Code, Codex, OpenCode and other agents that teaches them when to call jg versus their normal tools, and requires a key for Vercel AI Gateway, TypeSafe, OpenRouter, or OpenCode Zen. A reported ten-task SWE-bench repeat found ~40% lower coding-agent cost ($7.62 to $4.52) but a lower solve rate (7/10 vs 8/10 baseline), explicitly framed as a cost/quality tradeoff rather than a win.

Node.jsTypeScriptBun+4

JevTypeSafeVercel AI Gateway+7

coding-agents· Added 27 Sep 2026, published 26 Sep 2026

github.comrepo🛡️ Security

shai-hulud-detect: multi-ecosystem npm/PyPI/Composer/Crates/Go/Hex/RubyGems supply-chain worm scanner

shai-hulud-detect is a dependency-free Bash scanner that checks projects against a 5,782-entry list of compromised npm, PyPI, Composer, Crates, Go, Hex, and RubyGems package versions, plus content-pattern indicators of compromise (malicious file hashes, C2 domains, dead-man's-switch artifacts, forged commits, suspicious lifecycle hooks) tied to the Shai-Hulud supply-chain attack waves. It supports single-project and bulk scanning, CI-friendly exit codes, JSON/log output for pipeline gating, and a --check-host mode to detect the May 2026 gh-token-monitor/kitty-monitor persistence daemons that wipe hosts if their monitored GitHub token is revoked (with a documented safe remediation order). Detection is read-only; new package entries are sourced from named threat-research firms (Socket, StepSecurity, Aikido, Snyk, JFrog, Wiz, Semgrep, SafeDep, GitGuardian, OX Security) and cited in PRs.

npmPyPIComposer+3

Shai-Huludgh-token-monitorkitty-monitor

Supply Chain, DevSecOps· Added 23 Sep 2026

github.comrepo🛡️ Security

Shor

Shor is a source-available, multi-tenant autonomous pentesting platform where a ~17-agent LLM pipeline (discovery, hypothesis, adversarial screening jury, exploitation, proof replay) attacks a target URL and optionally its connected source repo. It wields 30+ real offensive tools (sqlmap, dalfox, nuclei, jwt_tool, hydra, ffuf, etc.) plus SAST/secret/SCA tools (Semgrep, Gitleaks, TruffleHog, OSV-Scanner, Trivy) in white-box mode, and only reports findings whose PoC is deterministically re-executed and confirmed by a code-enforced safety layer under a signed Rules of Engagement, with scan authorization gated behind single-use human-minted tokens on its MCP/automation surface.

SemgrepGitleaksTruffleHog+3

MITRE CAPECPolyForm Noncommercial License 1.0.0

Offensive Security, AppSec, AI Security· Added 22 Sep 2026, published 19 Sep 2026

rapid7.comadvisory🛡️ Security

CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

Rapid7's emerging threat response write-up on CVE-2026-76461, a critical (CVSS 9.8) SQL injection vulnerability in Cisco AsyncOS Software for Cisco Secure Email Gateway that allows an unauthenticated remote attacker to achieve root command execution by sending a specially crafted email. Cisco confirmed active zero-day exploitation and the vulnerability was added to CISA's KEV catalog the same day it was disclosed; the post provides mitigation guidance (emergency patching to 16.5.0-780) and a log-grep IOC (searching mail_logs for COPY.*TO PROGRAM) to detect exploitation attempts.

Cisco Secure Email GatewayCVSS

CVE-2026-76461CISA KEV

AppSec, Threat Intel· Added 7 Oct 2026, published 15 Sep 2026

tldrsec.comarticle🧠 AI

[tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms

tl;dr sec #345 is a weekly security newsletter issue. Its AI-relevant lead summarises Greptile's test of 500 PRs each from Claude Code and Codex: each model catches more high-severity bugs in the other's code, and Greptile built Model Inversion to route reviews to the opposite model. Other items cover an AI-written exploit from a vague bug description, Booz Allen's test of 18 LLMs as attackers, and an arXiv paper on open-weight agentic worms.

Claude CodeCodexGitHub+6

GreptileModel InversionClaude Opus 4.7+11

coding-agents, evals· Added 30 Oct 2026, published 10 Sep 2026

tldrsec.comarticle🛡️ Security

[tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms

tl;dr sec issue #345 is a security newsletter digest. It covers Greptile's test showing models miss bugs in their own code, an OCaml cohttp path traversal fix probed within ten minutes of the PR, and a Wiz Version Control DFIR poster for GitHub, GitLab, Bitbucket and Azure DevOps. It also covers an arXiv paper on open-weight agentic worms (61.8% infection of a 33-host testbed) and Endor Labs' 14 flaws in seven AI orchestration platforms.

GitHubGitLabBitbucket+3

path traversalprompt injectionModel Inversion+7

AI Security, AppSec, Blue Team & Detection· Added 30 Oct 2026, published 10 Sep 2026

github.comrepo🛡️ Security

The React Native Developer's Security Guide

A GitHub-hosted book focused entirely on securing the React Native developer's workstation and toolchain rather than the shipped app — covering the polyglot execution surface triggered by a single git clone/yarn/pod install (Ruby, CocoaPods, Xcode build phases/XCSSET, Gradle, gradle-wrapper.jar, keystores), CVE-2025-11953 (exposed Metro/RN dev server), ClickFix-style social engineering of developers, CI-as-extended-workstation risks, and Expo/EAS-specific supply-chain concerns. It ships alongside a separate companion repo of 119 Opengrep detection rules, each mapped to a specific chapter's attack technique, plus practical appendices like a safe-clone runbook and a file risk atlas for hardening teams.

React NativeExpoCocoaPods+3

CVE-2025-11953ClickFixXCSSET

Mobile Security, Supply Chain, DevSecOps· Published and added 5 Sep 2026

stepsecurity.iowriteup🛡️ Security

Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories - StepSecurity

StepSecurity documents Megalodon, a May 2026 campaign that injected backdoored GitHub Actions workflow files named SysDiag or Optimize-Build directly into 5,500+ public repositories in a six-hour window via direct Poisoned Pipeline Execution (d-PPE), exploiting weak branch protection. The base64-encoded bash payload harvests AWS/GCP/Azure credentials, SSH keys, Kubernetes/npm/Docker configs, GitHub OIDC tokens, and grep-matched secrets from the workspace, exfiltrating everything via HTTPS POST to a hardcoded C2 IP; the npm package @tiledesk/tiledesk-server was among the confirmed poisoned downstream targets.

GitHub ActionsnpmStepSecurity+3

MegalodonT1195.002Tiledesk+8

Supply Chain, DevSecOps, Threat Intel· Added 5 Sep 2026

aikido.devwriteup🛡️ Security

Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root

Aikido's analysis of "Dirty Frag," a set of Linux kernel bugs (CVE-2026-43284 in IPsec/XFRM ESP, CVE-2026-43500 in RxRPC, and the later variant CVE-2026-46300 "Fragnesia") that let a low-privileged local attacker write to the page cache of a read-only file they can only read, such as /usr/bin/su, and escalate to root. It explains the missing shared-memory check in splice()-fed ESP/RxRPC code paths, why the flaw reaches most kernel versions and distros via backports, how it enables container-to-node escapes in Kubernetes, and gives concrete host exposure checks (uname -r, lsmod grep for esp4/esp6/rxrpc, sysctl user.max_user_namespaces) plus detection guidance via audit logs and EDR.

Linux kernelKubernetesDocker

CVE-2026-43284CVE-2026-43500CVE-2026-46300+3

Offensive Security, Cloud & Infra, Blue Team & Detection· Added 5 Sep 2026, published 4 Sep 2026

endorlabs.comarticle🛡️ Security

SAST for AI-Generated Code: What Static Analysis Catches and Misses | Blog | Endor Labs

Endor Labs blog post arguing traditional signature-based SAST misses the logic and business flaws AI coding assistants introduce, since those flaws are "not pattern-shaped." It contrasts AI-assisted SAST (rules plus a thin AI layer) with AI-native SAST that traces dataflow across files and uses reachability analysis plus evidence-based triage to cut false positives, citing that Endor Labs' own tool (built on Opengrep with AI-agent triage) found a zero-day, CVE-2026-55407, in Anthropic's Rust buffa library and that only ~1 in 5 AI-recommended dependency versions are safe.

Endor LabsOpengrepRust

CVE-2026-55407OWASP Top 10 for LLM Applicationsslopsquatting+2

AppSec, AI Security, Supply Chain· Added 3 Sep 2026, published 2 Sep 2026

github.comrepo🛡️ Security

0sec-labs/0

"0" is an open-source security workflow runner from 0sec Labs (YC-backed, with a Swiss Applied AI & Cybersecurity Research Lab) usable from a terminal, a browser "Command Center," or a coding agent via MCP. It ships 12 starter templates (e.g. a "security-research" template that produces a source review of a demo API with code locations and suggested fixes), supports scheduled/triggered runs with retained results and revision history, and integrates with GitHub, Elastic, Semgrep, Snyk, Linear, Jira, Cloudflare, Slack and Teams via plugins.

Model Context ProtocolBunReact+1

FoxGuard

AI Security, AppSec· Added 2 Oct 2026, published 19 Aug 2026

adversa.aiarticle🛡️ Security

Top MCP security resources — August 2026

Adversa AI's monthly MCP security digest for August 2026, grouping ten resources: the July 28 MCP specification revision that hardens authorization (RFC 9207 issuer validation, deprecation of Dynamic Client Registration, a stateless core with header-based routing), a confused-deputy indirect prompt injection against Microsoft's Azure DevOps MCP server that hijacks a review agent into exfiltrating wiki data, SANS ISC telemetry showing 49 source IPs scanning for exposed MCP servers and agent credentials in two weeks, and new research (ChainWatch's kill-chain detection via Hidden Markov Models, SPELLSMITH's description-layer mitigations for taint-style flaws, MTGuard's static/dynamic tool-call analysis, and a 33-vulnerability taxonomy of agentic commerce platforms with the AIP-Bench benchmark). It closes with concrete upgrade guidance: audit DCR dependencies, validate issuers per RFC 9207, grep logs for MCP scanning indicators, and stand up a policy-enforcement gateway.

Model Context ProtocolOAuthAzure DevOps

RFC 9207SANS ISCChainWatch+5

AI Security, Identity & Access, AppSec· Added 7 Oct 2026, published 6 Aug 2026

github.comrepo🛡️ Security

Semgrep Rules (0xdea)

A "battle-tested" collection of Semgrep rules by researcher 0xdea aimed at C (and some C++) vulnerability hunting, covering buffer overflows, use-after-free/double-free, format string bugs, integer truncation/wraparound, command injection, insecure APIs (gets, strcpy, sprintf, scanf family), privilege management ordering, ReDoS, and dozens of other memory-safety and secure-coding checks. Rules are published to the Semgrep registry as "p/0xdea" and can be run directly via `semgrep --config "p/0xdea"` or cloned locally, with SARIF output support for triage in VS Code via SARIF Explorer. The repo also documents a roadmap including porting rules to the Semgrep Pro engine for taint/inter-procedural analysis.

SemgrepCSARIF+1

use-after-freedouble-freeformat string bugs+4

AppSec· Added 3 Sep 2026, published 31 Jul 2026

semgrep.devarticle🛡️ Security

AI code security harnesses compared

Semgrep's blog post compares open-source AI-driven code security "harnesses" that use LLMs to find vulnerabilities, grouping them into three categories: LLM-led exploit generation (fuzzing-like, crash-oracle driven), LLM-skill-boosting vulnerability research (e.g. Cloudflare's security-audit-skill, Trail of Bits' skills, CapitalOne's vulnhunter, Google's mantis), and SAST+LLM hybrids (raptor, deepsec, ai-deep-sast, Visa's VVAH). It breaks down each tool's design, star counts, licensing, and ideal use case, and discusses cross-cutting themes like adversarial validation, discovery/validation separation, and patch generation maturity.

SemgrepCodeQLClaude Code+5

tptacek

AI Security, AppSec· Added 3 Sep 2026, published 24 Jul 2026

github.comrepo🛡️ Security

Argo

Argo is an LLM-native static application security testing tool that drives Claude Code, Codex, Gemini, or local models (via Ollama/LM Studio) as an AI analyst to audit source code, extract security invariants, and produce reviewable vulnerability reports with optional patch generation and ASan-verified proof-of-concept crashes. It positions itself as a complement to rule-based SAST tools like CodeQL and Semgrep, targeting logic/authorization bugs that fixed patterns miss, and has been used to find real, disclosed vulnerabilities across 15 audited open-source projects (53 PRs, 2 CVEs). It supports two modes — general code audit and bug-bounty triage with scope-enforced, read-only, opt-in live verification guardrails.

Claude CodeCodexGemini+3

AppSec, AI Security· Added 3 Sep 2026, published 18 Jul 2026

opensourcemalware.comwriteup🛡️ Security

PolinRider Confirmed Footprint Grows 6.5x Since March

OpenSourceMalware's July hunt update on the PolinRider campaign (a Lazarus Group/DPRK operation linked to Contagious Interview and TasksJacker) found 2,417 newly-compromised GitHub repos, bringing the confirmed footprint to 4,367 repos across 2,152 owners — a 6.5x increase since March. The post breaks down the two injection vectors (94% config-file injection into files like postcss.config.mjs/tailwind.config.js/eslint.config.mjs, 6% payloads hidden in a .woff2 font file), shows the campaign overwhelmingly hits individual developer accounts rather than orgs, and republishes updated signature markers, decoder function names, and grep-based detection/remediation steps.

GitHubJavaScriptTypeScript+1

PolinRiderLazarus GroupDPRK+3

Supply Chain, Threat Intel· Added 3 Sep 2026, published 15 Jul 2026

Showing 30 of 46