Tracked topic
GitHub is a web-based platform for hosting and collaborating on software using Git version control, offering features such as pull requests.
… Download Now Related Articles: GitHub confirms breach of 3,800 repos via malicious VSCode extension 7-Eleven confirms data breach claimed by the ShinyHunters gang Grafana says stolen GitHub token let hackers steal codebase TeamPCP hackers advertise Mistral AI code repos for sale OpenAI confirms sec… …
… "One of our developers was compromised by a recent supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI gh . This allowed the attacker to run workflows on our GitHub repository as a contributor," the NX team said. …
… Download Now Related Articles: GitHub investigates internal repositories breach claimed by TeamPCP 7-Eleven confirms data breach claimed by the ShinyHunters gang Grafana says stolen GitHub token let hackers steal codebase TeamPCP hackers advertise Mistral AI code repos for sale OpenAI confirms secu… …
Grafana says stolen GitHub token let hackers steal codebase By Bill Toulas May 18, 2026 09:46 AM Grafana Labs disclosed that hackers have downloaded its source code after breaching its GitHub environment using a stolen access token. …
… Download Now Related Articles: Grafana says stolen GitHub token let hackers steal codebase TeamPCP hackers advertise Mistral AI code repos for sale Bitwarden CLI npm package compromised to steal developer credentials Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data GitHub investigat… …
… When GitHub credentials are available, the malware uses the GitHub API to automatically create new repositories under the victim’s account and upload the stolen data to them. Socket has found 1,900 publicly visible GitHub repositories matching the campaign’s markers. …
… Checkmarx says that its GitHub repositories are isolated from its customer production environment, and no customer data is stored in the GitHub repository. …
… The malware targets developer secrets, including: GitHub Actions OIDC tokens and PATs Git credentials npm publish tokens AWS Secrets Manager, IAM, and ESC task credentials Kubernetes service account tokens and cluster credentials HashiCorp Vault tokens SSH keys Claude Code configs VS Code tasks .en… …
… The Mini Shai-Hulud malware delivered in the campaign targeted the theft of developer and cloud credentials, including GitHub tokens, npm publish tokens, AWS credentials, Kubernetes secrets, SSH keys, and .env files. …
… The code retains the GitHub publishing functionality, so it uploads stolen credentials to public, auto-generated repositories. …