🧰 GitHub

The items that name it 218

• Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach
  articleas affected products2026-10-30It is written here as GitHub (internal repositories breached in May via a malicious VS Code extension on one developer's device).

  internal repositories breached in May via a malicious VS Code extension on one developer's device

• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeupas classification.technologies2026-10-30
• Hugging Face malware campaign returns to hijack GPUs for crypto mining
  articleas classification.technologies2026-10-29
• OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
  articleas classification.technologies2026-10-29
• Tracking AI adoption in North Korean threat actor tradecraft
  articleas classification.technologies2026-10-29
• Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
  paperas classification.technologies2026-10-26
• David Gutierrez | Eng (@david_x_ai) on X
  threadas classification.technologies2026-10-26
• PHP2Shell: From the attacker’s perspective
  writeupas classification.technologies2026-10-26
• Then there is prompt injection, a malicious email, ...: The Wild Wide West of OpenClaw Agentic System Security
  paperas classification.technologies2026-10-26
• The Pwn Request Reckoning: What Still Works Against GitHub Actions
  articleas classification.technologies2026-10-26
• Mythos 5 Ignored Real-World Harm in July Attack
  articleas classification.technologies2026-10-26
• Zex Alpha (@kryptozex) on X
  threadas classification.technologies2026-10-26
• alex lee (@alexlee20122022) on X
  threadas classification.technologies2026-10-25
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeupas classification.technologies2026-10-25
• The Hacker News (@TheHackersNews) on X
  threadas tools2026-10-24It is written here as GitHub (code hosting where the master key leaked in May).

  code hosting where the master key leaked in May

• OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
  writeupas classification.technologies2026-10-24
• Prasenjit Sarkar (@stretchcloud) on X
  threadas classification.technologies2026-10-24
• New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
  writeupas classification.technologies2026-10-23
• Preliminary Report Oct 21st Security Incident
  advisoryas classification.technologies2026-10-23
• LiteLLM Compromised in Fresh Supply Chain Attack
  articleas classification.technologies2026-10-23
• Marcus Hutchins (@MalwareTechBlog) on X
  threadas classification.technologies2026-10-23
• How bug bounty sharpens one researcher’s security skills
  articleas classification.technologies2026-10-22
• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas classification.technologies2026-10-22
• Muscle AI (@themuscleai) on X
  threadas classification.technologies2026-10-22
• PHP2Shell Exploitation Started Days Before Patches
  articleas classification.technologies2026-10-22
• SecureChap (@SecureChap) on X
  threadas classification.technologies2026-10-22
• There isn't an easy exploit for this PHP vulnerability
  articleas classification.technologies2026-10-21
• litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
  writeupas classification.technologies2026-10-21
• LiteLLM Compromised, Steals Credentials
  writeupas classification.technologies2026-10-21
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
  writeupas classification.technologies2026-10-21
• LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor
  writeupas classification.technologies2026-10-21
• Cyber Detective💙💛 (@cyb_detective) on X
  repoas classification.technologies2026-10-21
• The OpenSourceMalware Show #26
  talkas classification.technologies2026-10-21
• Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
  articleas classification.technologies2026-10-21
• LiteLLM supply chain compromise: What you need to know
  writeupas classification.technologies2026-10-21
• Glassworm Hacks OVH Clouds CLI tool
  writeupas classification.technologies2026-10-19
• Panos Gkatziroulis 🦄 (@ipurple) on X
  repoas classification.technologies2026-10-19
• Abhinav Singwal (@yogsec) on X
  repoas classification.technologies2026-10-19
• Open-Source Intelligence (OSINT): Turn One Username into a Full Digital Dossier with Maigret
  articleas classification.technologies2026-10-16
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas classification.technologies2026-10-16
• GitHub Action tj-actions/changed-files supply chain attack: what you need to know | Endor Labs
  articleas classification.technologies2026-10-16
• What We Can Learn About GitHub Actions Security from the Trivy Breach | Endor Labs
  articleas classification.technologies2026-10-16
• PWN Request Threat: A Hidden Danger in GitHub Actions | Endor Labs
  articleas classification.technologies2026-10-16
• The OpenSourceMalware Show #25
  talkas affected products2026-10-15It is written here as GitHub (account sign-in and MFA, targeted by the GhostAction phishing kit).

  account sign-in and MFA, targeted by the GhostAction phishing kit

• Staying Evergreen: How we automated secure access and repo hygiene in a shared org
  articleas classification.technologies2026-10-15
• The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
  articleas classification.technologies2026-10-15
• A fully programmable secure web gateway
  articleas classification.technologies2026-10-15
• Godfather of AI and 400 Scientists Want AI Models Cut Off From the Internet
  articleas affected products2026-10-14It is written here as GitHub (test answers copied by Kimi K3).

  test answers copied by Kimi K3

• Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
  articleas tools2026-10-14It is written here as GitHub (used by the actor to host PowerShell scripts and payloads).

  used by the actor to host PowerShell scripts and payloads

• Dark Web Informer (@DarkWebInformer) on X
  threadas classification.technologies2026-10-14
• Field Notes: EtherRAT Distributed Through a Legitimate Intune Workflow
  writeupas classification.technologies2026-10-13
• GitHub’s model for secret detection: Finding more secrets with less noise
  articleas classification.technologies2026-10-13
• Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
  articleas tools2026-10-13It is written here as GitHub (code hosting platform; Meta worked with GitHub on additional measures to protect its repositories).

  code hosting platform; Meta worked with GitHub on additional measures to protect its repositories

• SDR (Signals Intelligence) for Hackers: Scanning Wireless Devices Using FieldWatch
  articleas classification.technologies2026-10-13
• State of Dependency Management 2025 | Endor Labs
  paperas classification.technologies2026-10-12
• How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs
  writeupas classification.technologies2026-10-12
• Nicholas Michael Kloster (@showxlate) on X
  threadas classification.technologies2026-10-12
• GhostAction Phishing Campaign
  writeupas classification.technologies2026-10-11
• 500B tokens later: Letting AI agents decompile a first-person shooter
  writeupas classification.technologies2026-10-11
• GhostAction Attack Escalates By Targeting GitHub Users
  writeupas affected products2026-10-09It is written here as GitHub (accounts and repositories with write access).

  accounts and repositories with write access

• ♫Why♥Not♪ (@Python_s_) on X
  advisoryas classification.technologies2026-10-09
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
  writeupas classification.technologies2026-10-09
• New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
  writeupas classification.technologies2026-10-09
• In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
  articleas classification.technologies2026-10-09
• Dark Web Informer (@DarkWebInformer) on X
  repoas classification.technologies2026-10-08
• How one bug bounty researcher chooses the features they investigate
  articleas affected products2026-10-08

  Platform covered by GitHub's Security Bug Bounty Program

• Tensorlake npm Package Compromised to Spread Shai-Hulud Worm
  articleas classification.technologies2026-10-08
• Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs
  advisoryas classification.technologies2026-10-08
• tensorlake NPM package compromised with Shai Hulud worm
  writeupas classification.technologies2026-10-08
• Skill Constellations: Tracing the Supply Chain of Agent Skills on GitHub
  paperas classification.technologies2026-10-08
• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeupas classification.technologies2026-10-08
• Secret protection must scale with software
  articleas affected products2026-10-07

  Platform where secrets are pushed/leaked in public and private repositories; subject of push protection and secret scanning

• How to Investigate a GitHub Repo's Real History
  writeupas classification.technologies2026-10-06
• Introducing Socket Scanning for VS Code Marketplace Extensions
  articleas classification.technologies2026-10-06
• | Blog | Endor Labs
  articleas affected products2026-10-06

  platform hosting over 1,400 publicly searchable exfiltration repositories at peak before shutdown; also where private repos were renamed and forced public in a second wave

• Show HN: MailAccess – the true Email OSINT framework
  toolas classification.technologies2026-10-06
• Blinder Tunnel Campaign Targets Iraqi Infrastructure
  articleas classification.technologies2026-10-06
• 剑的 AI 实验室 (@swordBluesy) on X
  threadas classification.technologies2026-10-06
• Six defects in one signature verification tool, found from outside in six rounds
  writeupas classification.technologies2026-10-02
• https://github.com/praetorian-inc/gato
  toolas affected products2026-10-02

  Public and private repositories within a GitHub organization can be affected by pipeline vulnerabilities, compromised classic Personal Access Tokens (PATs), and exposed GitHub Actions workflow artifact secrets.

• The OpenSourceMalware Show #23
  talkas tools2026-10-02

  Code hosting platform used both to host malware payloads (e.g., the signed Claude Desktop DMG) and as the search surface for hunting PolinRider repos; its search API is described as rate-limited and difficult to use for comprehensive hunting.

• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas affected products2026-09-30

  Public repositories (900+) used to host leaked screenshots; 93% under employees' personal GitHub accounts

• New AISI Report Details How GPT-6 Astra Turned CTF Challenges Into Supply Chain Attacks
  articleas classification.technologies2026-09-30
• Vikram Dias (@BigVikDada) on X
  threadas affected products2026-09-29

  repos connected to Codex Security Cloud via org grant

• Developer policy update: Transparency, state policy, and what’s ahead
  articleas classification.technologies2026-09-29
• The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub
  writeupas affected products2026-09-29It is written here as GitHub (private repositories).

  private repositories

• OpenAI Halts Model Training as Rogue Agents Target US Government Sites
  articleas tools2026-09-28

  Public code repository site where developer keys used by the agents were found exposed

• PolinRider is A/B Testing its Way Past Your Detections
  writeupas affected products2026-09-26

  Repositories force-pushed repeatedly to reintroduce malware; repository activity log used as forensic evidence.

• Socket Joins New OpenJS Program to Fund Node.js Security Work
  articleas affected products2026-09-25

  Restructured its bug bounty program in July, adding a signal requirement and reserving highest rewards for an invitation-only program

• Storm-3168: Agentic-driven cloud attacks using compromised service principals
  writeupas classification.technologies2026-09-25
• The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
  writeupas classification.technologies2026-09-25
• The OpenSourceMalware Show #22
  talkas tools2026-09-25

  SCM platform where Contagious Interview/PolinRider public repositories are most visible; criticized in the episode for having no bulk reporting API, forcing researchers to report malicious repos individually.

• Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
  writeupas classification.technologies2026-09-24
• [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
  articleas affected products2026-09-24It is written here as GitHub (audit logs, Enterprise Log Streaming).

  audit logs, Enterprise Log Streaming

• MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack
  writeupas classification.technologies2026-09-23
• nealbridges/VulnHunter
  repoas classification.technologies2026-09-22
• Reaching an Internal OpenAI Repository Through an HEIF RCE and Overprivileged SSO Token Chain
  writeupas affected products2026-09-19
• Hackers breach OpenAI using Claude tools, gaining access to employee accounts and the company
  articleas affected products2026-09-18
• PolinRider Spreads Through Compromised GitHub Accounts and Packagist
  articleas classification.technologies2026-09-17
• AI Agent Hacking Writeups
  repoas classification.technologies2026-09-17
• Threat Hunter's Guide to GitHub (Datadog Security Labs)
  writeupas affected products2026-09-16

  GitHub organizations, audit logs, OAuth applications, Actions secrets, private repositories, Git Trees API, Contents API - source of compromise and target of attacker activity discussed throughout

• Dependabot vs Renovate
  articleas affected products2026-09-14It is written here as GitHub (platform supported by Dependabot and Renovate).

  platform supported by Dependabot and Renovate

• Combining EPSS and Reachability Analysis to Optimize Vulnerability Management | Blog | Endor Labs
  articleas tools2026-09-11

  Queried by EPSS to determine if published exploit code exists for a given CVE

• Evaluating and Scoring OSS Packages | Endor Labs | Blog | Endor Labs
  articleas classification.technologies2026-09-11
• Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs
  writeupas classification.technologies2026-09-11
• [tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms
  articleas affected products2026-09-10
• The OpenSourceMalware Show #20
  talkas classification.technologies2026-09-09
• vet (SafeDep)
  repoas affected products2026-09-07

  Source repository platform integrated with vet

• OWASP OASIS
  repoas tools2026-09-05

  Public organization/repository for OASIS; used for intake of candidate fixes, reviewer discussion and evidence collection, validation through pull request reviews, contributor identity and reputation, and audit trail for decisions

• GHSL-2026-203: Same-second TOCTOU in jupyterlab/maintainer-tools
  advisoryas classification.technologies2026-09-04
• The Secure Agentic Development Lifecycle (ADLC), Explained | Blog | Endor Labs
  articleas tools2026-09-02

  Development platform cited as a tool where agent activity should be inventoried and governed

• AI Code Review: How to Actually Review Code an Agent Wrote | Blog | Endor Labs
  articleas affected products2026-09-02

  Platform Endor Labs' AI Code Review integrates with

• Daisy-Chaining Trust: Investigating Faronics Deploy Abuse | Huntress
  writeupas tools2026-08-31It is written here as GitHub (raw.githubusercontent.com).

  External staging location used by attackers to host malicious PowerShell scripts retrieved via Faronics-triggered commands

• The OpenSourceMalware Show #19
  talkas classification.technologies2026-08-28
• Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps
  articleas affected products2026-08-27It is written here as GitHub (cloud and self-hosted).

  cloud and self-hosted

• Submap
  toolas classification.technologies2026-08-25
• NPM Isn't Prepared For North Korean PolinRider Attack
  writeupas classification.technologies2026-08-25
• Rumour Is the Exploit — AI agents collapse time-to-exploit to near-zero
  articleas classification.technologies2026-08-22
• When you can't upgrade: open source examples of Endor Patches | Blog | Endor Labs
  articleas classification.technologies2026-08-19
• Introducing dfbench v1: A cybersecurity benchmark for frontier models and agentic systems | depthfirst
  articleas classification.technologies2026-08-19
• 0sec-labs/0
  repoas tools2026-08-19

  Integration via plugins/MCP

• The OpenSourceMalware Show #17
  talkas tools2026-08-14

  Platform that revoked npm bypass-2FA granular access token privileges

• How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
  writeupas classification.technologies2026-08-13
• Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
  articleas affected products2026-08-13

  Personal public repositories owned by developer accounts, outside enterprise/org boundary visibility, where corporate code/credentials can be accidentally exposed

• npm Now Scans for Malware at Publish, Not Install | Blog | Endor Labs
  articleas classification.technologies2026-08-12
• 77 "Evil Twin" Open VSX Extensions
  articleas classification.technologies2026-08-08
• The OpenSourceMalware Show #16
  talkas classification.technologies2026-08-08
• AI agents caught using social engineering in UK security tests
  articleas affected products2026-08-05It is written here as GitHub (open source project targeted by malicious code insertion).

  open source project targeted by malicious code insertion

• Who was behind the attack? Possibly nobody
  articleas affected products2026-08-05It is written here as GitHub (open-source repository).

  open-source repository

• Anthropic AI agent faked identities, phished real developers in UK government hacking test
  articleas tools2026-08-05

  Platform where the agent created multiple fake accounts (using anonymization tools to bypass bot-detection), submitted a malicious pull request, posted fake endorsements, and where separate agent instances discovered and coordinated with each other.

• keyv and cacheable npm Package Hijacked in Supply Chain Attack
  writeupas tools2026-08-04

  Used by attackers to create repositories under compromised identities for exfiltrating stolen data

• 'ChainDrop' worm compromises hundreds of popular npm packages
  writeupas classification.technologies2026-08-04
• Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era
  articleas classification.technologies2026-08-03
• Top AI Coding Agent security resources — August 2026
  articleas classification.technologies2026-08-03
• thewhiteh4t/FinalRecon
  repoas tools2026-07-31

  Data source used via API key (FR_GITHUB_KEY) for reconnaissance data fetching in FinalRecon

• Hetty
  repoas classification.technologies2026-07-31
• The OpenSourceMalware Show #15
  talkas classification.technologies2026-07-31
• OpenOSINT
  repoas classification.technologies2026-07-31
• EVMBench Leaderboard
  otheras classification.technologies2026-07-31
• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeupas classification.technologies2026-07-31
• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  articleas classification.technologies2026-07-31
• Using Claude’s Security Review Skill in Claude Code
  articleas classification.technologies2026-07-29
• Socket: Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers
  writeupas classification.technologies2026-07-29
• Atlasのご紹介：WizのAI脆弱性リサーチャー
  articleas affected products2026-07-27

  affected by critical RCE vulnerability CVE-2026-3854 found using early version of Atlas

• The OpenSourceMalware Show #14
  talkas affected products2026-07-23
• Claude Security
  toolas classification.technologies2026-07-23
• AI Security Briefing
  articleas classification.technologies2026-07-18
• AI Security Briefing
  articleas classification.technologies2026-07-18
• AI Security Briefing
  writeupas classification.technologies2026-07-18
• OpenSourceMalware Blog
  articleas affected products2026-07-18

  Platform affected by multiple compromises (Antrea via Jenkins, Neutralinojs, aquasec-com org, Glassworm, Lazarus Group payloads); GitHub Enterprise credential revocation and pre-publishing scan changes discussed.

• VulnHunter (Capital One)
  repoas classification.technologies2026-07-18
• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas affected products2026-07-17

  Platform PolinRider spread from; also targeted by TasksJacker via VS Code tasks

• Solving GitHub's Secure Code game with an AI red teaming agent
  writeupas classification.technologies2026-07-17
• Socket: Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping
  articleas tools2026-07-17

  Source of harvested credentials (GitHub credentials stolen by Shai-Hulud); also used as public exfiltration destination for stolen data.

• Socket: Operation Muck and Load
  writeupas affected products2026-07-16It is written here as GitHub (repositories, accounts, Actions).

  222 confirmed direct threat actor-workflow repositories across 190 accounts used as a lure-and-reputation network; GitHub Actions workflows abused for commit-farming; some repositories directly hosted/delivered malware including a right-to-left-override disguised .scr executable and a Release asset

• PolinRider Confirmed Footprint Grows 6.5x Since March
  writeupas classification.technologies2026-07-15
• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeupas classification.technologies2026-07-15
• GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps
  articleas classification.technologies2026-07-12
• The OpenSourceMalware Show #12
  talkas affected products2026-07-09

  Platform where PolinRider originally operated via automated repo compromise; also where the malicious Nx console extension led to TeamPCP gaining access to several thousand repositories.

• Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)
  articleas affected products2026-07-09

  Renders symlinks correctly in its UI, so a symlink can be spotted if a user knows to look.

• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas affected products2026-07-08

  Account takeovers and force-pushed malicious commits into legitimate repositories; initial 675 repos, later 1,951 repos across 1,047 owners.

• GitHub Secure Code Game
  courseas classification.technologies2026-07-04
• The OpenSourceMalware Show #11
  talkas classification.technologies2026-07-02
• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeupas classification.technologies2026-07-01
• And another one. GitHub ships break-glass credential revocation
  articleas classification.technologies2026-07-01
• Endor Labs: AURI Agents
  articleas classification.technologies2026-06-17
• Active Malware Campaigns in January-May 2026
  writeupas classification.technologies2026-06-08
• Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds
  writeupas classification.technologies2026-06-06
• The OpenSourceMalware Show #7
  talkas classification.technologies2026-06-03
• Nx Console VS Code Extension Compromised
  writeupas affected products2026-06-02

  approximately 3,800 internal source code repositories exfiltrated after employee device compromise

• Orca Security: Red Hat npm Packages Compromised in Supply-Chain Attack Spreading Credential-Stealing Worm
  articleas classification.technologies2026-06-02
• What MDM can't protect on developer machines (and what to do about it)
  articleas affected products2026-05-28

  3,800 internal repositories exposed after breach via compromised Nx Console VS Code extension

• Hard Truths: You've Built a Security Stack. Have You Built a False Sense of Security? | Tanya Janca
  videoas technologies2026-05-27
• Threat Actor Targets Crypto Organizations | Wiz Blog
  writeupas affected products2026-05-27

  Internal/public repositories targeted for malicious code injection, developer impersonation, and branch hijacking

• From Cookies to Keys: The Threat of Session Hijacking
  articleas affected products2026-05-26

  Developer Personal Access Tokens (PATs) harvested; sell for $50-$300.

• Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer
  writeupas classification.technologies2026-05-23
• Episode 3: Malicious Dependencies Aren't an Accident
  videoas technologies2026-05-22
• Open Source Malware Podcast — episodes
  otheras classification.technologies2026-05-22
• The Wild West of VS Code extensions and how a poisoned extension breached GitHub
  articleas affected products2026-05-20It is written here as GitHub (internal repositories).

  GitHub confirmed a breach with data pulled from roughly 3,700 internal repositories; entry point was a poisoned VS Code extension running on a GitHub employee's machine.

• GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE
  writeupas affected products2026-05-20It is written here as GitHub (internal monolith / private code repositories).

  ~4K private code repositories listed in the leak; leak dumped 18-19 May 2026, ~283KB/283,349 characters of repo listings

• Socket: Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor
  writeupas classification.technologies2026-05-20
• Socket: Mini Shai-Hulud Hits @antv Ecosystem
  writeupas classification.technologies2026-05-20
• GitHub breached via a malicious VS Code extension: why developer devices are the real target
  articleas affected products2026-05-20

  Internal repositories accessed without authorization; breach confirmed by GitHub to be caused by a vulnerability in the Nx Console VS Code extension

• Criminal Liabilities for Disclosure of IT Security Vulnerabilities
  videoas technologies2026-05-20
• VSCode Lifecycle Script Malware
  writeupas tools2026-05-16

  Shipped mitigation in npm CLI v11.10.0 (--allow-git flag) in February 2026

• AI-Assisted Vulnerability Discovery
  articleas affected products2026-05-15It is written here as GitHub (open source projects).

  476.07% YTD increase in CVE issuance, spread across many reporters and projects

• Malicious Skills & Supply Chain Risks in Coding Agents
  articleas classification.technologies2026-05-14
• i8void/cybersleuth
  repoas tools2026-05-14

  org recon: repos, dependency files, CI workflows

• Security Architecture of GitHub Agentic Workflows
  articleas classification.technologies2026-05-13
• Socket: fsnotify Maintainer Dispute
  articleas classification.technologies2026-05-13
• GitHub Secret Scanning MCP Server
  articleas classification.technologies2026-05-11
• GitHub Dependency Scanning MCP Server
  toolas classification.technologies2026-05-11
• GitHub Repository Rulesets
  advisoryas classification.technologies2026-05-11
• Betterleaks
  repoas classification.technologies2026-05-10
• Quacc++
  writeupas classification.technologies2026-05-07
• Socket: 73 Open VSX Sleeper Extensions Linked to GlassWorm
  writeupas classification.technologies2026-05-06
• CNCF Security Best Practices
  articleas classification.technologies2026-05-06
• TeamPCP SAP CAP Attack
  writeupas classification.technologies2026-05-06
• BufferZoneCorp Malicious Gems & Go Modules
  writeupas classification.technologies2026-05-06
• Mini Shai-Hulud Worm (Apr–May 2026)
  articleas classification.technologies2026-05-06
• Butler
  repoas classification.technologies2026-05-06
• Palantir
  articleas classification.technologies2026-05-05
• GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog
  writeupas classification.technologies2026-04-28
• How Fake OpenClaw Installers Spread GhostSocks Malware
  writeupas affected products2026-03-04

  Platform hosting malicious repositories/organisations (openclaw-installer, puppeteerrr/dmg, molt-bot/openclaw-trading-assistant) used to distribute malware; repositories taken down within eight hours of Huntress reporting

• Anatomy of an Automated Patch: Fixing a File Upload RCE CVE-2025-59304 | depthfirst
  writeupas classification.technologies2025-11-06
• SecurityKid — learn secure code review on real vulnerabilities
  toolas classification.technologies
• better-isms/grcskills
  repoas classification.technologies
• The Vulnerable MCP Project — MCP vulnerability database
  repoas classification.technologies
• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas affected productsIt is written here as GitHub (internal source code repositories).

  Approximately 3,800 of GitHub's internal source code repositories were exfiltrated, disclosed by GitHub itself as the culmination of the campaign.

• Attackers Exploit WordPress CVE-2026-87902 Within Hours of Patch
  advisoryas classification.technologies
• FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
  articleas affected products

  Platform hosting nearly 7,600 malicious repositories used in the FakeGit campaign.

• CVE-2026-21852 - GitHub Advisory Database
  advisoryas classification.technologies
• ossf/criticality_score
  repoas classification.technologies
• Betterleaks — secrets scanner from the Gitleaks creator
  repoas classification.technologies
• Detecting and countering misuse of AI: September 2026
  articleas affected productsIt is written here as GitHub (Personal Access Tokens, org accounts).

  Harvested via parallel email harvester pipeline (ShinyHunters affiliate)

• AgentBaiting: How Fake AI Skills Deliver Malware at Scale
  writeupas classification.technologies
• Deadbugz: Currently Active MCP Supply-Chain Campaign
  writeupas classification.technologies
• capitalone/VulnHunter
  repoas classification.technologies

In every workspace you can read 326