Tracked topic
GitHub is a web-based platform for hosting and collaborating on software using Git version control, offering features such as pull requests.
Grafana says stolen GitHub token let hackers steal codebase By Bill Toulas May 18, 2026 09:46 AM Grafana Labs disclosed that hackers have downloaded its source code after breaching its GitHub…
VS Code zero-day lets hackers steal GitHub tokens in one click By Sergiu Gatlan June 3, 2026 02:50 AM A security researcher has released exploit code for a Visual Studio…
FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware By Bill Toulas July 21, 2026 06:34 PM A large-scale operation dubbed ‘FakeGit’ is pushing SmartLoader and StealC malware…
The ‘Miasma’ worm source code briefly leaked on GitHub By Bill Toulas June 10, 2026 04:27 PM The Miasma credential-stealing attack framework, which has recently targeted open-source ecosystems through…
NFCShare Android malware spreads via fake banking app updates on GitHub By Bill Toulas June 8, 2026 06:11 PM New variants of the NFCShare Android malware are being distributed as fake…
…GitHub, PyPI add time-based defenses against supply chain attacks FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware AsyncAPI npm packages infected with credential-stealing malware Nearly 300 GitHub…
Grafana breach caused by missed token rotation after TanStack attack By Bill Toulas May 20, 2026 11:46 AM The Grafana data breach was caused by a single GitHub workflow token that…
…GitHub tokens and GitHub Actions secrets npm, PyPI, RubyGems, JFrog publishing tokens AWS, GCP, Azure, Kubernetes, and Vault credentials SSH keys Docker credentials .env, .npmrc, .pypirc Shell histories Claude/MCP configuration files…
…Red Hat packages backdoored through GitHub compromise According to Aikido, the attackers allegedly compromised a Red Hat employee's GitHub account and used it to push malicious commits directly to multiple repositories…
…GitHub announces npm security changes to tackle supply-chain attacks GitHub disables Microsoft repos pushing password-stealing malware New IronWorm malware hits 36 packages in npm supply-chain attack New Shai-Hulud…