On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two ...
Several packages in the @redhat-cloud-services npm scope were found to carry malicious payloads that fire via a preinstall hook on every npm install. The affected versions span multiple packages ...
@bitwarden/cli@2026.4.0 — the official command-line interface for the Bitwarden password manager — was found compromised on npm. A malicious preinstall hook silently bootstraps the Bun JavaScript ...
All release tags in the Checkmarx/kics-github-action repository have been compromised with an infostealer payload. If you are using this Action pinned to any version tag, treat your CI/CD secrets as ...
AI agent skills live in two places. Developers install them on their own machines, and teams commit them to repositories so everyone who works in the codebase gets them. A skill often travels between ...
On October 5, 2026, StepSecurity analyzed @subql/common@5.8.3 on npm and identified a hidden payload that collects credentials and supports remote shell access. It starts during installation and when ...
The malicious release was built from the project's own main branch and published with an npm provenance attestation. On October 5, 2026, StepSecurity analyzed @subql/common@5.8.3 on npm and identified ...
What we tried before We relied on native GitHub Actions controls plus our own conventions, action pinning, permission scoping, and code review. Those are a strong baseline, but by design they're ...
On May 22, 2026, an attacker with push access to the Laravel-Lang GitHub organization rewrote every git tag across multiple popular Composer packages within a single 15 minute window. Anyone running ...
For MemoryOS 2.0.34, include hosts where a normal import could reach logging initialization. Remove or quarantine the affected release and use an independently vetted replacement; this inspection did ...
Despite the sensitive roles CI/CD runners play (accessing source code, secrets, and deployment systems), compliance requirements often don’t explicitly call them out. As a result, security teams may ...
TeamPCP has launched a new wave of their Mini Shai-Hulud worm. The self-propagating malware, which spreads by stealing CI/CD secrets, compromised several @tanstack npm packages, collectively ...
Results that may be inaccessible to you are currently showing.
Hide inaccessible results