“GitHub”

Mini Shai-Hulud/npm campaign compromises popular packages, indicating coordinated supply-chain poisoning activity.

Keyv-linked npm worm poisoned hundreds of packages, injecting Claude code and VS Code hooks to steal credentials and spread.

DarkSword iOS exploit kit expanded across 180 web properties, targeting iOS 18.4-18.7 to steal sensitive device data.

Open-source AiTM phishing kits proxy live Microsoft 365 auth sessions, capturing tokens and bypassing MFA protections.

Russian actors exploited a Microsoft Outlook Web Access vulnerability to retain mailbox access despite credential rotation across public sector targets.

Insurance-targeted phishing now triggers immediate real-time account hijacking rather than delayed credential theft for timely money transfer fraud.

CVE-2026-42533 in nginx script engine enables crashing worker processes and potential remote code execution since 2011.

Four @asyncapi npm packages were compromised to distribute a multi-stage botnet loader with credential-stealing payloads.

AsyncAPI packages were trojanized after attacker stole an npm publishing token via GitHub Actions, risking developer and CI compromise.

Miasma v3 delivered via trojanized AsyncAPI packages creates persistent backdoors on developer machines and build servers.

CISA publishes after-action lessons following contractor exposure of AWS GovCloud credentials and IaC repos on public GitHub.

Compromise of Injective Labs' GitHub published @injectivelabs/[email protected] npm package that exfiltrates crypto wallet keys and seeds.

Malicious jscrambler npm v8.14.0 runs a preinstall hook that drops a cross-platform Rust infostealer during package install.

Miasma worms compromised a large set of Microsoft GitHub repositories via a supply-chain attack.

Vulnerability enables token theft from GitHub via a simple interaction; affects developer workflows.

A single-click payload can exfiltrate GitHub OAuth tokens from vulnerable repos via VS Code workflows.

Malicious code was injected into @redhat-cloud-services packages, enabling credential theft across developer environments. Immediate package revocation and scans advised.

Coordinated disruption of Glassworm infrastructure; assess supply-chain risk and harden package sources.