Packagist packages hid malicious package.json scripts, enabling Linux binary execution during installs and workflows.

GitHub’s internal repositories — now staged publishing in npm 11.15.0 requires a human 2FA approval before any package goes ...

OpenAI confirms a severe 2026 supply chain attack compromised internal repositories. Discover how this TanStack security ...

Researchers say the campaign abused compromised access tokens and deploy keys to inject malicious GitHub Actions workflows ...

GitHub Actions is why developers can't leave GitHub despite dozens of outages — and why Microsoft stopped pretending it was ...

GitHub confirms breach of 3,800 internal repos after employee installs poisoned VS Code extension - SiliconANGLE ...

The Megalodon supply chain attack poisoned over 5,500 GitHub repositories via automated commits injecting GitHub Actions workflows.

GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS ...

Sometime in early 2025, an attacker slipped malicious code into a Visual Studio Code extension, and a GitHub employee ...

GitHub faces an internal repository breach this week after a poisoned VS Code extension on an employee device exposed roughly 3,800 internal repositories. Customer data stored outside those ...