🧰 GitHub CLI

The items that name it 11

• LiteLLM Compromised in Fresh Supply Chain Attack
  article2026-10-23It is written here as GitHub CLI: its OAuth tokens were stolen and used to disable branch protections and alter the release workflow.
• Dark Web Intelligence (@DailyDarkWeb) on X
  thread2026-10-22It is written here as GitHub CLI (source of the OAuth tokens).

  source of the OAuth tokens

• SecureChap (@SecureChap) on X
  thread2026-10-22It is written here as GitHub CLI: its stolen OAuth tokens were used to trigger and approve the release workflow.
• The OpenSourceMalware Show #25
  talk2026-10-15It is written here as GitHub CLI (used to install the workflow lockfile extension).

  used to install the workflow lockfile extension

• 500B tokens later: Letting AI agents decompile a first-person shooter
  writeup2026-10-11It is written here as GitHub CLI (agents manage one issue per translation unit).

  agents manage one issue per translation unit

• The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
  writeup2026-09-25It is written here as GitHub CLI (gh).

  gh

• dstours/OctoC2
  repo2026-07-18

  Required when using Codespaces tunneling transport

• VulnHunter (Capital One)
  repo2026-07-18It is written here as GitHub CLI (gh).

  authenticated access to target repositories, required by the fixer

• Cybersecurity Startup Publishes Infostealers to NPM
  writeup2026-07-09It is written here as GitHub CLI (gh).

  Legitimate developer tool whose local config file (~/.config/gh/hosts.yml) was read by the malware to extract GitHub user and email fields

• Socket: actions/checkout v7 Blocks Unsafe pull_request_target Checkouts
  article2026-06-22

  mentioned as an alternative means (besides git, custom scripts, or other actions) by which a workflow could still pull attacker-controlled code, bypassing the checkout-specific protection

• capitalone/VulnHunter
  repoIt is written here as GitHub CLI (gh).

  Required by the vulnhunter-fix skill, authenticated to target repositories

In every workspace you can read 16