45 results for “GitHub Action”

Endor Labs breaks down the May 11, 2026 compromise of 42 @tanstack/* npm packages (84 malicious versions) that carried valid SLSA provenance. The attacker chained a pull_request_target "Pwn Request", GitHub Actions cache poisoning across the fork/base boundary, and OIDC token extraction from Runner.Worker memory, then published directly to npm without stealing any credential. It explains why 2FA, trusted publishing, provenance and branch protection all failed, and lists mitigations: split pull_request_target workflows, treat the cache as untrusted, scope id-token: write to a publish job, pin actions to SHAs, require environment approval, use egress allowlists.

endorlabs.comwriteupPublished and added 12 Oct 2026🛡️ Security

StepSecurity details a new wave of the GhostAction campaign in which attackers used compromised maintainer accounts of Takashi Kitao (pyxel) and Henry Wu (athenadriver, Uber) to push malicious "Security Audit" GitHub Actions workflows to 345 repositories in minutes. The upgraded payload now runs `git log -p --all` to mine an entire git history (not just current secrets) for thirteen credential patterns including AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, and SendGrid keys, pairs AWS access key IDs with secret keys via context capture, and exfiltrates everything via raw-IP plain-HTTP POST to 193.32.204.199, bypassing DNS-based defenses. The post includes hunting queries, run-log forensics confirming successful exfiltration from uber/athenadriver, and remediation guidance centered on workflow approval gates and egress allowlisting.

stepsecurity.iowriteupPublished and added 9 Oct 2026🛡️ Security

Socket documents an October 8, 2026 wave of the GhostAction campaign in which two compromised GitHub maintainer accounts (henrywoo and kitao) pushed a malicious security-audit.yml workflow to 346 repositories, including uber/athenadriver and the 18,420-star kitao/pyxel. Beyond the original GhostAction technique of harvesting named GitHub Actions secrets, this variant adds a full git-history grep (via fetch-depth: 0 and git log -p --all) for 13 credential patterns covering AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs, Google/Firebase keys and SendGrid keys, plus a context-window capture around AWS key IDs to reconstruct usable key pairs, all exfiltrated in cleartext to a single hardcoded IP.

socket.devwriteupPublished and added 9 Oct 2026🛡️ Security

StepSecurity's investigation of @subql/common@5.8.3, a malicious npm release in the SubQuery Web3 indexing framework's monorepo, found a heavily obfuscated postinstall/import-time payload (base64+XOR+gzip inside a function constructed via Function()) that spawns a detached worker to steal credentials (.npmrc, .env, AWS, SSH, kubeconfig, Vault, cloud secrets), read GitHub Actions runner memory for CI secrets, inject a camouflaged "Run Copilot" GitHub Actions workflow to exfiltrate repo secrets, and provide a remote shell/PTY over an encrypted channel to ci-artifacts.dev. The release was published via a compromised build pipeline: a workflow modification swapped the real build output for an externally downloaded, unsigned tarball from that same C2 domain immediately before publish, and the authors provide IOCs and remediation steps (credential rotation, host isolation, domain blocking).

stepsecurity.iowriteupPublished and added 5 Oct 2026🛡️ Security

Socket reports that the actions-cool/issues-helper and actions-cool/maintain-one-comment GitHub Actions, compromised in the May 2026 Mini Shai-Hulud campaign and disabled by GitHub, were re-enabled on September 16, 2026 with their release tags still pointing to the malicious code. Any workflow referencing them by tag (about 15,000 dependents for issues-helper alone) resumed running the Bun-executed obfuscated payload. Workflow run logs show the switch from fast "Repository access blocked" failures to multi-minute successful runs. The post gives remediation: SHA-pin actions, rotate secrets, and hunt for oven-sh/setup-bun and bun run index.js in runner logs. An update says both repos were disabled again on September 25.

socket.devwriteupPublished and added 24 Sep 2026🛡️ Security

StepSecurity documents a supply-chain attack against @memtensor/memos-cloud-openclaw-plugin on npm (versions 0.1.21, 0.1.23, 0.1.25) and MemoryOS 2.0.34 on PyPI, which insert a hidden "sckit" launcher into normal plugin/import lifecycle code (no install scripts) to spawn a platform-specific Go binary that harvests the parent process's environment and the user's AI prompt text. The Go payloads contain regex patterns for AWS, GitHub, GitLab, npm, PyPI, Hugging Face, Vault, Slack, Stripe and SendGrid credentials, target the user's home directory as an inventory root, and beacon to skyleen.fr "front" domains; the PyPI variant additionally hides a conditional build-backend/CI bridge that can steal PYPI_API_TOKEN during publishing and pull a hash-pinned, Ed25519-signed secondary payload via GitHub Actions. The writeup includes full IOC/remediation guidance.

stepsecurity.iowriteupPublished and added 23 Sep 2026🛡️ Security

Socket's Threat Research Team details a supply-chain compromise of four @asyncapi npm packages (generator-helpers, generator-components, generator, specs) published via a poisoned source commit through GitHub Actions trusted publishing. The packages contain an obfuscated load-time (not install-hook) implant that spawns a detached Node.js process to fetch an IPFS-hosted, AES-256-GCM-encrypted loader delivering the "Miasma" botnet/tasking framework, which supports REST C2, multi-channel comms (Nostr, IPFS, Ethereum RPC, BitTorrent DHT), shell execution, file exfiltration, and systemd persistence. Includes full technical analysis, IOCs, hashes, and MITRE ATT&CK mapping.

socket.devwriteupAdded 21 Sep 2026🛡️ Security

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

endorlabs.comwriteupPublished and added 11 Sep 2026🛡️ Security

StepSecurity documents Megalodon, a May 2026 campaign that injected backdoored GitHub Actions workflow files named SysDiag or Optimize-Build directly into 5,500+ public repositories in a six-hour window via direct Poisoned Pipeline Execution (d-PPE), exploiting weak branch protection. The base64-encoded bash payload harvests AWS/GCP/Azure credentials, SSH keys, Kubernetes/npm/Docker configs, GitHub OIDC tokens, and grep-matched secrets from the workspace, exfiltrating everything via HTTPS POST to a hardcoded C2 IP; the npm package @tiledesk/tiledesk-server was among the confirmed poisoned downstream targets.

stepsecurity.iowriteupAdded 5 Sep 2026🛡️ Security

Presents a tiered trust checklist for evaluating third-party GitHub Actions before referencing them in a workflow, covering maintenance/tooling signals, unpinned transitive dependencies, release attestations, and governance, with weaker popularity-based signals separated into a second tier. It then argues that any point-in-time trust assessment only holds if the referenced commit is immutable, and compares raw SHA pinning against GitHub's immutable releases and the new gh-actions-lock CLI extension, which verifies commit reachability to defeat impostor-commit attacks. It closes by noting StepSecurity's GitHub Action Advisor automates some of the checklist's queryable signals using Harden-Runner telemetry.

jessehouwing.netwriteupAdded 21 Sep 2026, published 4 Sep 2026🛡️ Security

StepSecurity documents how an external GitHub user (p00paboot) hijacked the release workflow of @7nohe/openapi-react-query-codegen by exploiting an npm publish issue-comment trigger that lacked commenter authorization checks, allowing pull-request code to be checked out and published via GitHub Actions OIDC trusted publishing. Ten malicious versions were pushed with preinstall hooks and a poisoned binding.gyp that executed a payload downloading Bun, stealing GitHub/git credentials, probing GCP metadata, and enumerating SSH keys, confirmed via StepSecurity Harden-Runner behavioral analysis on isolated runners. The post lists affected versions, file/hash IOCs, and remediation steps including credential rotation and pinning to clean releases.

stepsecurity.iowriteupAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

StepSecurity's forensic writeup on a compromised crates.io maintainer account that published poisoned releases of arrayref (245M downloads), internment, and append-only-vec, each pulling in proc-macro1, a typosquat of proc-macro2 impersonating David Tolnay whose build.rs silently drops and executes a cross-platform stage-2 payload at compile time. The attacker also mass-yanked clean arrayref versions to funnel Cargo's "yanked" warning toward the one poisoned release, and StepSecurity reproduced the attack in GitHub Actions with Harden-Runner, capturing the C2 callback to 23.254.165.112:9089 and demonstrating automatic blocking via a global IOC block list. The post includes the full attack timeline, dropper base64-obfuscated URL scheme, SHA-256 hashes, C2 IOCs, and remediation/detection guidance for lockfiles and CI caches.

stepsecurity.iowriteupAdded 3 Sep 2026, published 22 Aug 2026🛡️ Security

Wiz's autonomous "Red Agent" discovered a GitHub Actions script-injection vulnerability in snowflakedb/snowflake-connector-net's jira_issue.yml workflow, introduced when a PR (co-authored by GitHub Copilot) replaced a safe env:/jq pattern with direct interpolation of the attacker-controlled issue title. GitHub Advanced Security scanned the same PR and workflow but failed to flag the injection; Red Agent autonomously crafted and self-corrected a payload after a bash syntax error, exfiltrated Jira OAuth credentials via an out-of-band callback, and used them to access Snowflake's internal Jira (engineering, security, and bug-bounty projects) — all without human intervention. Snowflake patched and rotated credentials the same day the flaw was reported via HackerOne.

wiz.iowriteupAdded 3 Sep 2026, published 17 Aug 2026🛡️ Security

DocsGPT documents the security practices it adopted through GitHub's Secure Open Source Fund: a public STRIDE-based THREAT_MODEL.md, mitigations for its sandboxed AI code-execution feature (scrubbed env vars, NetworkPolicy blocking internal IPs and cloud-metadata to stop SSRF, off-by-default), a dependency-tree audit with SPDX SBOM export and Dependabot, and CI automation using custom CodeQL queries, Bandit, zizmor for GitHub Actions hardening, and secret scanning. It's a practical baseline playbook for maintainers dealing with high volumes of AI-authored PRs that can't all be manually reviewed.

blog.docsgpt.cloudwriteupPublished and added 15 Aug 2026🛡️ Security

Wiz's H1 2026 cloud threat report documents a 60% jump in significant incidents driven by a doubling of supply-chain attacks (TeamPCP's npm/PyPI/GitHub Actions credential-harvesting spree, its open-sourced Shai-Hulud worm spawning Miasma/Hades/Megalodon/IronWorm follow-ons, North Korea's axios and @mastra trojanizations) and by growing attacks on AI infrastructure, including exposed unauthenticated MCP servers, LiteLLM/Dify/Langflow/n8n/Ollama vulnerabilities, and cryptominers deployed via a Langflow RCE. It also profiles JINX-0163, a cloud-native extortion group targeting non-human identities (service accounts/IAM roles) across AWS/Azure/GCP/Okta/Snowflake linked to the "FulcrumSec" extortion brand, and closes with concrete detection techniques for stolen access keys, Kubernetes VM Run Command abuse, GCP org-policy tampering, and CloudTrail user-agent/boto3 credential-provenance mismatches.

wiz.iowriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

Snyk Security Research independently verified an active npm supply-chain compromise affecting keyv@6.0.0 and 10 related packages (cacheable family, ecto) published by maintainer jaredwray on August 4, 2026, adding a preinstall hook (setup.mjs) that loads a 727KB obfuscated second-stage payload (Math_Symbol.js) targeting GitHub/npm/cloud credentials, private keys, and Vault/Kubernetes tokens via a gh-token-monitor persistence mechanism. The attack also planted .claude/settings.json and .vscode/tasks.json hooks to trigger execution when developers open the repo in Claude Code or VS Code, and the malicious release was signed by a valid npm trusted-publisher (GitHub Actions) attestation, demonstrating that provenance can faithfully attest a build whose source was already compromised. Snyk provides byte-level tarball diffs, a minute-by-minute incident timeline, and remediation steps including pinning to keyv@5.6.0, hunting for gh-token-monitor persistence, and credential rotation.

snyk.iowriteupAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security

ChainDrop is an npm worm that compromised hundreds of packages on 4 August 2026, some with over 150 million weekly downloads, starting from a malicious commit (174f6a5) in the keyv repository. Datadog dissects the Bun-based loader, the obfuscated second stage, credential theft (files, GitHub Actions runner memory, AWS, Kubernetes, Vault), Ethereum smart-contract C2 discovery, AES/RSA exfiltration, an eval channel, and propagation via stolen npm tokens, GitHub branches and Sigstore provenance. IOCs and a list of affected packages are included.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 4 Aug 2026🛡️ Security

Endor Labs dissects "SANDWORM_MODE", a multi-stage npm supply-chain attack using typosquatted packages (e.g. suport-color, fake claude-code) that combines credential theft, worm-like propagation via npm and GitHub Actions, and DNS/HTTPS/GitHub API exfiltration with a domain generation algorithm. Notably it installs a rogue MCP server into AI coding assistants (Cursor, Claude Code, Windsurf, Continue) and uses prompt injection to trick the AI into silently exfiltrating SSH keys, AWS credentials, and password-manager secrets. The post walks through the three-layer deobfuscation chain (Base64 + zlib + XOR + eval), differential-analysis detection techniques, and disabled destructive dead-switch/polymorphic-rewrite features.

endorlabs.comwriteupAdded 27 Jul 2026🛡️ Security

Socket researchers traced malicious dev versions of ten Packagist packages owned by developer dinushchathurya back to compromised GitHub repositories containing 55-62 malicious GitHub Actions workflow files each. The workflows execute on GitHub-hosted Ubuntu runners on every push, download an architecture-matched Linux payload from C2 server 43.228.157.68, and run an internet scanner (`ipscan --exploit CVE-2026-41940`) that exploits an authentication bypass in cPanel/WHM and harvests cloud, database, SSH, and source-control credentials, exfiltrating results via heartbeat/results HTTP endpoints and DNSHook callbacks. GitHub code search for the campaign's unique markers returned 6,100-16,000 matching workflow files across unrelated repositories, indicating the abuse extends far beyond the one compromised maintainer and effectively weaponizes GitHub Actions as free, disposable attack infrastructure.

socket.devwriteupPublished and added 23 Jul 2026🛡️ Security

On July 14, 2026, attackers compromised push access to two AsyncAPI GitHub repositories (asyncapi/generator and asyncapi/spec-json-schemas) and pushed malicious commits under a placeholder git identity that triggered legitimate CI/CD release workflows (release-with-changesets.yml, if-nodejs-release.yml), publishing five malicious npm package versions (@asyncapi/generator, generator-helpers, generator-components, specs) carrying a runtime-triggered obfuscated dropper for the Miasma RAT, complete with valid OIDC/SLSA provenance attestations. StepSecurity detected the packages within 30 minutes, used Harden-Runner in an isolated GitHub Actions job to capture the malware's C2 traffic (HTTP plus IPFS/Nostr/BitTorrent DHT fallback channels), and pushed the IOCs to their Global Block List to block exfiltration across customer pipelines; all malicious versions have since been unpublished.

stepsecurity.iowriteupAdded 3 Sep 2026, published 16 Jul 2026🛡️ Security

Wiz Research details how an attacker used 37 decoy pull requests to mask exploitation of a pull_request_target "pwn request" misconfiguration in the asyncapi/generator GitHub Actions workflow, stealing a privileged PAT belonging to the asyncapi-bot service account. The attacker then published four malicious npm packages (five versions) under the @asyncapi namespace with over 3 million weekly downloads, delivering a self-identified "M-RED-TEAM v6.4" multi-stage payload that fetches an 8.25MB encrypted bundle from IPFS and installs a 92,000-line trojan framework with systemd persistence and HTTP/Nostr/Ethereum/libp2p C2 channels, targeting browser credentials, SSH keys, npm/GitHub tokens, AWS credentials, and crypto wallets. The piece also analyzes partial technical overlap with the Miasma malware framework and the unrelated prt-scan campaign without making definitive attribution.

wiz.iowriteupAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

Aikido Security details how five @asyncapi npm packages (specs, generator, generator-helpers, generator-components), combined ~2.9M weekly downloads, were backdoored after an attacker exploited an unmerged pull_request_target GitHub Actions vulnerability in asyncapi/generator to steal the npm publish token via 37 flooded PRs. The injected runtime code spawns a detached Node process that downloads an encrypted stage-2 loader from IPFS, decrypts it via HKDF/AES-256-GCM, and drops a persistent remote-shell implant self-identified as 'M-RED-TEAM v6.4' with Miasma-branded artifacts, though credential harvesting and self-propagation are disabled in this build. The post includes full technical detail on the exfiltration flow, IOC strings, IPFS CIDs, and inconclusive attribution linking it to the prior Miasma toolkit and prt-scan campaign.

aikido.devwriteupAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

On July 8, 2026, a compromised maintainer account pushed malicious commits directly to the master branch of the InjectiveLabs/injective-ts monorepo, triggering the repo's own OIDC-based GitHub Actions publish pipeline to release backdoored version 1.20.21 of @injectivelabs/sdk-ts and 17 dependent packages. The payload, disguised as 'key derivation telemetry,' hooked PrivateKey.fromMnemonic() and PrivateKey.fromHex() to capture BIP-39 seed phrases and raw private keys, batched and base64-encoded them, and exfiltrated them via the X-Request-Id header of HTTPS requests to a typosquat-style domain (testnet.archival.chain.grpc-web.injective.network) mimicking legitimate Injective gRPC-Web traffic. The destination hostname was obfuscated as a JavaScript char-code array to evade plaintext string scans, and the packages were reverted to clean 1.20.23 roughly 49 minutes after the malicious release.

stepsecurity.iowriteupAdded 3 Sep 2026, published 12 Jul 2026🛡️ Security

Analysis of a supply-chain compromise of @bitwarden/cli version 2026.4.0, published to npm for ~1.5 hours on April 22, 2026, which added a preinstall script (bwsetup.js) that downloads a Bun runtime and executes a 10MB obfuscated payload (bw1.js) harvesting CI secrets like SSH keys and API tokens and exfiltrating them to attacker-created public GitHub repos in victims' namespaces. The compromise is linked to a prior breach of Checkmarx's GitHub Actions (checkmarx/ast-github-action), used in Bitwarden's repo, and the payload includes CI/CD platform detection across 30+ platforms and a Russian-locale self-exclusion check consistent with Eastern European threat actor tooling, framed as part of the "Shai-Hulud" campaign lineage.

endorlabs.comwriteupAdded 3 Sep 2026, published 10 Jul 2026🛡️ Security

StepSecurity walks through the TeamPCP-led compromise of aquasecurity/trivy-action (CVE-2026-33634, CVSS 9.4), where attackers force-pushed a credential-stealing payload into 76 of 77 version tags, plus the related Checkmarx KICS action compromise, both harvesting secrets from /proc/pid/mem of the GitHub Actions Runner.Worker process and exfiltrating to a typosquatted domain (scan.aquasecurtiy.org, 45.148.10.212). The post details the attack technique of 'imposter commits' (fork commits reachable by SHA but not on any branch) used to hide the malicious tags, and situates the incident alongside the same-window CanisterWorm npm worm and TeamPCP credential stealers in litellm and telnyx PyPI packages, then maps ten StepSecurity/Harden-Runner defense-in-depth controls (egress blocking, process lockdown, SHA-pinning PRs, imposter-commit scanning, global blocklist) to each stage of the kill chain.

stepsecurity.iowriteupAdded 3 Sep 2026, published 2 Jul 2026🛡️ Security

Step Security's incident analysis of the compromise of codfish/semantic-release-action, a widely used GitHub Action wrapping semantic-release. An attacker force-pushed a malicious commit and repointed seven version tags to it, converting the action from a Docker runner to a composite action that installs Bun and runs an obfuscated 512KB payload via if: always() steps. The payload steals GitHub OIDC tokens and PATs, uses a novel GitHub commit-message dead-drop for C2, has a Russian-locale killswitch, and locked tags immutable via GitHub Rulesets to block remediation.

stepsecurity.iowriteupAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

StepSecurity documents a June 24, 2026 attack that published malicious versions of 20 Leo Platform npm packages (including leo-logger and leo-sdk) within a 3-second window, using the same "Phantom Gyp" binding.gyp install-hook technique, three-layer obfuscation chain, and Bun runtime evasion seen in the earlier Miasma campaign (57 packages, June 3, 2026). The payload steals GitHub Actions runner memory, cloud/registry/password-manager credentials, exfiltrates via GitHub dead-drop commits using the victim's own token, self-propagates by publishing to any package the victim can access via the npm bypass_2fa mechanism, and escalates privileges via passwordless sudo on runners. The post includes IOCs and maps defenses (Harden-Runner, Secure Registry cooldowns, PR-based compromised-package checks) to each stage of the attack.

stepsecurity.iowriteupAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

Socket Threat Research documents a new wave of the Miasma Mini Shai-Hulud npm supply-chain campaign compromising @immobiliarelabs Backstage plugins for GitLab integration and LDAP authentication, published on June 26, 2026. The malicious tarballs (e.g. @immobiliarelabs/backstage-plugin-gitlab@7.0.2) add a hidden root-level index.js triggered via the "Phantom Gyp" node-gyp binding.gyp trick, which decrypts an AES-128-GCM payload, bootstraps Bun, and steals npm/GitHub/cloud/SSH/CI-CD secrets while planting GitHub Actions and AI-IDE persistence. The report also traces a plausible root cause to the earlier compromise of codfish/semantic-release-action (tag-hijacking reported by StepSecurity) and highlights abuse of GitHub's deployment event trigger — a technique flagged by researcher Adnan Khan — to run attacker workflows without touching protected workflow files.

socket.devwriteupPublished and added 27 Jun 2026🛡️ Security

Walks through a GitHub Actions pipeline that spins up a kind cluster, deploys the SecureCodeBox operator, the Juice Shop target and the ZAP-Advanced scanner, then runs an authenticated full scan. Findings summaries are pulled from the Scan resource status and the full findings.json from MinIO, then compared with a baseline report committed to the repo to flag new, persistent or resolved categories. The pipeline fails the build when issues remain. It gives a reusable pattern for DAST regression tracking in CI.

medium.comwriteupAdded 3 Sep 2026, published 25 Jun 2026🛡️ Security

Aikido Security details how codfish/semantic-release-action, a widely used GitHub Action for automated releases since 2019, was compromised via an imposter-commit attack: an attacker force-pushed two orphan commits (disguised with reused real commit metadata) and retargeted sixteen tags including the floating v2–v5 majors to point at them. The malicious action.yml was rewritten as a composite action that still calls the legitimate action first so runs appear successful, then loads Bun via oven-sh/setup-bun and executes a heavily obfuscated 781KB index.js payload targeting GITHUB_TOKEN and NPM_TOKEN secrets. The payload contains the dead-drop marker "thebeautifulsnadsoftime," tying it to the leaked Miasma credential-stealing toolkit, which polls GitHub's public commit search API for that string to fetch and eval() attacker commands instead of using traditional C2 infrastructure.

aikido.devwriteupAdded 3 Sep 2026, published 24 Jun 2026🛡️ Security

Attackers adopted 400+ orphaned AUR (Arch User Repository) packages and injected malicious build logic that pulled in a malicious npm dependency (masquerading as atomic-lockfile, also seen as js-digest), dubbed the "Atomic Arch" campaign by Sonatype researchers. The malicious npm package deploys a Rust-based credential stealer targeting browser cookies, SSH keys, GitHub/npm tokens, and cloud/Docker credentials, with optional eBPF-based rootkit persistence on rooted systems. The piece explains scope (Arch, EndeavourOS, Manjaro, WSL2-based Arch, self-hosted Arch CI runners) and draws parallels to similar ownership-hijacking risks in npm, PyPI, GitHub Actions, and Homebrew.

stepsecurity.iowriteupAdded 3 Sep 2026, published 18 Jun 2026🛡️ Security

StepSecurity documents the Mastra AI framework npm supply-chain attack: attacker sergey2016 published easy-day-js, a typosquat clone of dayjs, then added it as a dependency across 140+ @mastra packages after compromising the org's npm credentials. The malicious 1.11.22 version's postinstall hook ran an obfuscated dropper (setup.cjs) that disabled TLS verification, beaconed the install path, fetched a stage-2 payload from a hardcoded C2, spawned it detached, and self-deleted to erase forensic traces; StepSecurity's Harden Runner blocked the C2 callout in a controlled GitHub Actions test, preventing credential exfiltration of LLM/cloud API keys.

stepsecurity.iowriteupAdded 3 Sep 2026, published 18 Jun 2026🛡️ Security

OpenSourceMalware's analysis of active malware campaigns from January-May 2026, covering Lazarus Group's Contagious Interview (fake recruiter outreach delivering BeaverTail/InvisibleFerret via npm, PyPI, Go, Cargo, Packagist) and two new campaigns, TasksJacker (malicious .vscode/tasks.json auto-execution, including payloads hidden in .woff2 font files and fake VS Code dictionary files) and PolinRider (weaponizing stolen credentials via malicious PRs merged into projects like VS Code, Apache Superset, Rails, LangFlow, Expo). It also details TeamPCP's supply chain attack on Trivy's GitHub Actions repos using a leaked Aqua Security PAT to force-push malicious commits across 76 version tags.

opensourcemalware.comwriteupPublished and added 12 Jun 2026🛡️ Security

StepSecurity's forensic analysis of the June 5, 2026 Miasma worm incident, in which a compromised contributor account pushed a malicious commit to Microsoft's Azure/durabletask repository planting five files (.claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json, and a 4.6MB obfuscated .github/setup.js payload) that trigger credential-harvesting code execution the moment the repo is opened in Claude Code, Gemini CLI, Cursor, or VS Code — no package install or code run required. GitHub's automated abuse detection disabled 73 Microsoft repositories in a 105-second sweep, including Azure/functions-action, breaking CI/CD pipelines across GitHub Actions users relying on the mutable @v1 tag. The post ties this to the same compromised account behind the May 19 durabletask PyPI credential-stealer campaign and the broader TeamPCP-linked Miasma worm, which has infected 113+ repositories.

stepsecurity.iowriteupAdded 3 Sep 2026, published 9 Jun 2026🛡️ Security

Investigates GitHub's mass disabling of 73 Microsoft repositories across the Azure, Azure-Samples, microsoft, and MicrosoftDocs orgs within a 105-second window on June 5, all flagged for ToS violations, including the widely-used Azure/functions-action GitHub Action that broke CI pipelines globally. The author links the takedown to a re-compromise of the durabletask PyPI package (previously hit May 19 by TeamPCP via stolen GitHub Actions secrets) and to Miasma, a rebrand of TeamPCP's open-sourced Mini Shai-Hulud worm that Aikido and OX Security found had added Azure/GCP credential collectors and self-propagates by committing stolen secrets into attacker-created public repos, which is what likely triggered GitHub's automated abuse enforcement.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 6 Jun 2026🛡️ Security

Snyk documents an active npm supply-chain attack ("Node-gyp Supply Chain Compromise - June 2026") that abuses binding.gyp's GYP command-expansion syntax (<!(...)) to trigger arbitrary code execution via node-gyp during npm install, bypassing detection tools that only monitor preinstall/postinstall scripts. The worm, tracked as "Phantom Gyp"/"Miasma" (a Shai-Hulud descendant) by StepSecurity, has hit 57 packages including autotel-* and @vapi-ai/server-sdk, harvests npm/GitHub/AWS/GCP/Azure/Vault/Kubernetes credentials via a multi-stage obfuscated Bun-based loader, injects GitHub Actions workflows for persistence, and self-propagates by republishing from compromised maintainer accounts.

snyk.iowriteupAdded 3 Sep 2026, published 4 Jun 2026🛡️ Security

StepSecurity documents a supply-chain attack where a single actor compromised four Laravel-Lang Composer packages (laravel-lang/lang, http-statuses, actions, attributes) by rewriting every existing git tag to point at malicious commits that add src/helpers.php to Composer's eager autoload.files map. On any composer install/update or app boot, the payload fetches a stage-2 loader and an ELF binary from the C2 domain flipboxstudio.info, exfiltrates CI/runner secrets, then self-deletes and reparents to init to evade forensics. The team confirmed end-to-end exploitation by detonating laravel-lang/http-statuses v3.4.5 inside a Harden-Runner-monitored GitHub Actions runner, capturing the full process tree, network calls, and providing recovery/IOC guidance for affected users and maintainers.

stepsecurity.iowriteupAdded 3 Sep 2026, published 2 Jun 2026🛡️ Security

Aikido details a June 2026 compromise of 96 versions across 32 @redhat-cloud-services npm packages (116,991 weekly downloads) with "Miasma," a new variant of the TeamPCP-authored Mini Shai-Hulud credential-stealing worm whose source was open-sourced in May 2026. Attackers compromised a Red Hat employee's GitHub account to push malicious orphan commits containing a GitHub Actions workflow that abused OIDC id-token: write permissions to authenticate to npm's trusted publishing endpoint and republish backdoored packages; each package's preinstall script then ran a 4.2MB obfuscated payload that swept GitHub Actions, AWS, GCP, Azure, Vault, Kubernetes, npm/PyPI, SSH, Docker, GPG, and .env credentials. The piece also lays out the broader Mini Shai-Hulud campaign timeline (Bitwarden CLI, SAP, PyTorch Lightning, Mistral/TanStack, Microsoft DurableTask) and full IOC package/version list.

aikido.devwriteupAdded 3 Sep 2026, published 1 Jun 2026🛡️ Security

Socket's AI scanner found a coordinated supply chain campaign in which 8 Packagist (PHP/Composer) packages had their upstream GitHub repos modified to add a malicious postinstall hook — placed in package.json rather than composer.json — that downloads a binary (gvfsd-network) from an attacker GitHub Releases URL to /tmp/.sshd, disables TLS verification, and runs it in the background. The same payload was also found injected into GitHub Actions workflow files (as a step named "Dependency Cache Sync") in forked repos, and a GitHub code search for the attacker account parikhpreyash4 surfaced hundreds of additional references across Node.js projects. Highest real-world risk is concentrated in Laravel starter kits devdojo/wave (~6,400 stars) and devdojo/genesis (~9,100 Packagist installs), since starter-kit repos become the project root where npm install triggers the hook directly.

socket.devwriteupPublished and added 23 May 2026🛡️ Security

Socket's Threat Research team found 84 compromised @tanstack npm package artifacts (including @tanstack/react-router, 12M+ weekly downloads) injected with an obfuscated router_init.js credential-stealing payload targeting GitHub Actions CI secrets and OIDC tokens. The attack chained a pull_request_target "Pwn Request" pattern, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime OIDC token extraction, allowing attacker publishes via TanStack's legitimate trusted-publisher OIDC binding without stealing npm tokens. Socket ties it to the ongoing Mini Shai-Hulud campaign, attributed to a likely-compromised GitHub account, and provides hashes, IOCs (filev2.getsession[.]org), and hardening/remediation steps.

socket.devwriteupPublished and added 20 May 2026🛡️ Security

StepSecurity and Endor Labs document a second wave of the Mini Shai-Hulud npm worm spreading through the compromised 'atool' account, which publishes timeago.js and maintains packages in Alibaba's @antv namespace, hitting echarts-for-react, jest-canvas-mock and dozens of other packages. The payload scrapes GitHub Actions Runner.Worker process memory to steal masked CI/CD secrets, harvests 130+ credential file paths (cloud, SSH, Kubernetes, Vault, crypto wallets, Claude Code/VS Code configs), exfiltrates via a GitHub API dead-drop in antvis/G2 or a fake-OpenTelemetry C2 at t.m-kosche.com, drops persistent backdoors in Claude Code/VS Code, and has already used stolen GitHub tokens to spin up 2,500+ dead-drop repositories. The writeup includes full process/network telemetry from Harden-Runner showing the attack blocked, deobfuscated payload internals, IOCs, and detection/remediation guidance.

stepsecurity.iowriteupPublished and added 19 May 2026🛡️ Security

Aikido details a new wave of the Mini Shai-Hulud npm worm that has compromised 373 malicious package-version entries across 169 package names, including TanStack, Mistral AI, UiPath, and Squawk packages. Unlike the earlier SAP-focused wave (setup.mjs/execution.js), this version drops a root-level router_init.js and adds a malicious GitHub-hosted optionalDependency (@tanstack/setup) whose prepare script silently runs a Bun-based credential stealer targeting npm/GitHub tokens, AWS/Kubernetes/Vault secrets, and GitHub Actions OIDC tokens, then abuses trusted publishing to self-propagate by minting fresh npm publish tokens and pushing new compromised releases. The post includes full affected-package/version lists, file hashes, network IOCs, and remediation/rotation guidance.

aikido.devwriteupAdded 3 Sep 2026, published 11 May 2026🛡️ Security

Socket researchers found that Bitwarden CLI 2026.4.0 was compromised via a hijacked GitHub Action in Bitwarden's CI/CD pipeline, part of the ongoing Checkmarx-themed supply chain campaign. The malicious bw1.js payload shares C2 infrastructure and code (gzip+base64 packed Python memory-scraper, Bun-based runtime, GitHub Actions workflow injector) with the earlier Checkmarx mcpAddon.js attack, but adds new indicators like a lock file, shell-profile persistence, and overt "Shai-Hulud: The Third Coming" / Butlerian Jihad ideological branding, plus a kill switch for Russian-locale systems. It harvests GitHub, AWS, Azure, GCP, npm, SSH, and Claude/MCP credentials and exfiltrates via GitHub commits and npm republishing.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

Socket researchers traced the GitHub account BufferZoneCorp to a cluster of typosquatted RubyGems (knot-prefixed gems impersonating ActiveSupport, Devise, Rack/Rails, and RSpec tooling) and Go modules (mimicking go-retryablehttp, envconfig, and generic infra libraries) that shipped as dormant sleeper packages before later updates added credential theft, GitHub Actions and go.sum tampering, fake go binary wrappers on PATH, and SSH authorized_keys persistence. The Ruby gems exfiltrate SSH keys and AWS, npm, gh, and gitconfig credentials via extconf.rb install hooks to a webhook.site endpoint, while the Go modules disable GOSUMDB, poison GOPROXY, strip go.sum checksums, and hijack the go binary in CI runners. Go's Security team blocked the identified modules after disclosure, but the Ruby gems and GitHub account remained live at time of writing.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

A researcher builds "Vulnerability Spoiler Alert," an open-sourced GitHub Action that uses Claude to continuously scan commits and associated pull requests in monitored repos, flagging likely security patches before a CVE is ever published. The post walks through prompt-tuning iterations (adding PR context, requiring a concrete exploit PoC, using the assistant-prefill trick to force clean JSON output), a timing case study showing an ~2-hour "negative-day" window on the React2Shell patch versus CVE feed publication, and a verified command-injection "never-day" the tool surfaced in vercel/next.js's @next/codemod (execSync with unsanitized shell interpolation), reproduced with a trojanized package.json PoC.

spaceraccoon.devwriteupPublished and added 5 May 2026🛡️ Security