🧰 StepSecurity

The items that name it 48

• Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
  writeupas classification.technologies2026-10-30
• LiteLLM Compromised in Fresh Supply Chain Attack
  articleas tools2026-10-23It is written here as StepSecurity: security firm that noted the RAT checks a GitHub dead drop every hour and runs whatever Python the attacker serves.
• eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update
  articleas classification.key entities2026-10-22
• OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond
  articleas classification.technologies2026-10-18
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas tools2026-10-16It is written here as StepSecurity (reported 345 repositories hit by October 8 sweeps; report cited).

  reported 345 repositories hit by October 8 sweeps; report cited

• The OpenSourceMalware Show #25
  talkas classification.key entities2026-10-15
• GhostAction Attack Escalates By Targeting GitHub Users
  writeupas classification.key entities2026-10-09
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
  writeupas classification.technologies2026-10-09
• StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines
  articleas classification.technologies2026-10-08
• A trust checklist for GitHub Actions
  writeupas classification.technologies2026-09-04
• Introducing deny list egress policies for Harden-Runner
  articleas classification.key entities2026-09-02
• Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners
  articleas classification.key entities2026-09-02
• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
  writeupas classification.key entities2026-08-28
• Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper
  writeupas classification.technologies2026-08-22
• Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It
  articleas classification.key entities2026-08-03
• Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
  writeupas classification.technologies2026-07-25
• Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
  articleas classification.key entities2026-07-23
• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
  writeupas classification.technologies2026-07-19
• Introducing Secret Exfiltration Protection for GitHub Actions
  articleas classification.key entities2026-07-16
• Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories
  writeupas classification.key entities2026-07-16
• Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners
  articleas classification.key entities2026-07-16
• jscrambler npm package publishes malicious preinstall binary
  writeupas classification.key entities2026-07-12
• 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions
  writeupas classification.technologies2026-07-02
• StepSecurity Maintained Actions Are Now Free for Public Repos
  articleas classification.technologies2026-07-02
• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeupas classification.key entities2026-07-01
• Maven Support Comes to GitHub Checks and OSS Package Search
  articleas classification.technologies2026-07-01
• Socket: Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages
  writeupas tools2026-06-27

  Security vendor that reported the compromise of codfish/semantic-release-action

• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas classification.key entities2026-06-18
• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeupas classification.technologies2026-06-18
• The OpenSourceMalware Show #8
  talkas classification.key entities2026-06-11
• Miasma & Hades Worms
  writeupas classification.key entities2026-06-10
• New in the Threat Center: Compromised Components, Now Available via API
  articleas classification.technologies2026-06-09
• cicd-sensor: eBPF Runtime Security for CI/CD Pipelines
  repoas tools2026-06-04

  paid platform (built on Harden-Runner) adding private repository/self-hosted runner support, dashboards, and policy management

• Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
  writeupas classification.key entities2026-06-04
• Dev Machine Guard Now Scans Extensions Across Every Modern IDE
  articleas classification.technologies2026-06-02
• Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
  writeupas classification.technologies2026-06-02
• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeupas classification.technologies2026-05-19
• FOSSA: Mini-Shai-Hulud Mass Compromise
  writeupas tools2026-05-18

  External security research firm that first reported the attack

• Cooldowns.dev
  articleas tools2026-05-06

  GitHub check ('Package Cooldown') that fails PRs introducing/updating dependencies published within the last N days (default 2); covers npm, PyPI, Maven, NuGet.

• Supply Chain Compromise of axios npm Package
  writeupas tools2026-03-31

  Credited write-up/effort in sounding the alarm about the supply chain attack; source for several mitigation recommendations

• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas classification.technologies
• Active Supply Chain Attack: Malicious node-ipc Versions Published to npm
  writeupas classification.technologies
• Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
  articleas tools

  Security firm that published a report on the campaign; researcher Ashish Kurmi quoted on OIDC token hijacking

• Dev Machine Guard Now Supports Windows - StepSecurity
  articleas classification.technologies
• Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories - StepSecurity
  writeupas classification.technologies
• Dev Machine Guard Now Supports Linux - StepSecurity
  articleas classification.technologies
• Introducing Secure Registry: install-time defense for the npm supply chain - StepSecurity
  articleas classification.key entities
• actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecurity
  advisoryas classification.technologies