“GitHub”

Malicious tensorlake npm release deploys Shai-Hulud worm stealing developer secrets and spreading through developer systems.

Iranian-affiliated Blinder Tunnel campaign used a booby-trapped Dubai Airports coding test to target Iraqi critical infrastructure for persistence and tunneling.

JADEPUFFER (Storm-3168) used compromised Azure service principals to delete resources and perform destructive cloud operations.

Previously compromised GitHub Actions were re-enabled while still pointing to Mini Shai-Hulud malicious payloads, reactivating risk.

Compromised MemTensor packages on npm/PyPI delivered sckit Go-based implant across Windows, Linux, and macOS.

Malicious npm package indexed-btree disguised as sorted-btree and hid a malware loader inside runtime prototype code.

CrowdSec says TanStack npm supply-chain attack enabled theft of about 170 private GitHub repositories from CrowdSec.

Plugin4Shell allows repo owners to swap pinned plugin code, enabling supply-chain subversion of AI coding agents like Claude Code and Codex.

Attacker hijacked an AI coding-assistant session to poison recommendations and spread Shai-Hulud across ~100 internal repositories, stealing secrets.

Researcher released a zero-day 'ShieldCrash' exploit targeting Windows Defender components, enabling local bypasses and exploits.

Researcher Chaotic Eclipse published a PoC for an alleged Avast Antivirus privilege-escalation zero-day affecting Windows 11 systems.

Australian authorities arrested two suspects tied to TeamPCP supply-chain attacks that tampered with open-source developer tools.

Researchers found over 50,000 exposed Stripe API keys, increasing fraud and payment compromise risk for merchants.

CISA added a critical Ray vulnerability to its Known Exploited Vulnerabilities catalog due to observed active exploitation.

Research demonstrates DRAM scrambling manipulation that undermines protections around SMM, PSP, and CPU microcode memory zones.

Flaws in Claude Code and Google's Gemini CLI let an unprivileged GitHub issue execute code on CI runners and expose secrets.

Analysis links TeamPCP to Redis attacks from 2020 and to later supply-chain campaigns via overlapping infrastructure and domains.

ChainDrop npm worm compromised 400+ packages, impacting components with combined monthly installs exceeding two billion.