Supply Chain Attack
Supply-chain audit work for organizations using GitHub-hosted CI/CD: a research firm found a recurring pull-request handling and workflow-permission pattern that left 300-plus repositories open to attacker-controlled code execution.
Supply Chain Attack
Microsoft's attribution analysis ties the JavaScript-ecosystem compromise to a North-Korea-linked cluster, assessing with high confidence that the actor it tracks as Sapphire Sleet published poisoned Mastra packages to reach developers and crypto wallets.
Vulnerabilities
A WordPress plugin vulnerability requires API-key rotation work for affected site administrators, after researchers found an unauthenticated endpoint leaking live mail-provider credentials from roughly 100,000 installations.
Supply Chain Attack
Another contributor-account compromise hits the JavaScript ecosystem — defenders using Mastra packages have inventory and rotation work this week.
Supply Chain Attack
The default flips — npm 12 changes the install-script behavior that has driven years of supply-chain reform debate.
Supply Chain Attack
Miasma's open-sourcing turns the previous day's Microsoft-repo incident into the first instance of a much broader supply-chain threat any actor can now reproduce.
Supply Chain Attack
For the second time in weeks, Microsoft packages were laced with credential stealers — this time targeting users of AI coding agents, forcing the company to pull more than 70 of its own GitHub repositories.
Supply Chain Attack
Another package-poisoning incident lands across a language registry, reinforcing the case for default-behavior reform that GitHub has now begun applying to npm.
Supply Chain Attack
Three disclosures this cycle share one thesis: attackers borrowing the trust of legitimate channels. A Rust-written npm worm (IronWorm), a cryptominer slipped into Hola Browser, and a Magecart skimmer hosted inside Stripe each hide in traffic defenders are inclined to allow.
Vulnerabilities
Researcher Ammar Askar disclosed a one-click attack via VS Code's GitHub.dev that steals a GitHub OAuth token with read-write access to private repos. He published the PoC with about an hour's notice, blaming Microsoft's disclosure process.
Vulnerabilities
Researcher RyotaK of GMO Flatt Security found a flaw in Anthropic's Claude Code GitHub Action that let a single opened issue take over public repos running it. Anthropic fixed it within days (v1.0.94) and paid a bounty; the durable lesson is product-agnostic.
Supply Chain Attack
A compromised Red Hat employee GitHub account pushed a new 'Miasma' build of the Mini Shai-Hulud worm into 32 Cloud Services npm packages. Red Hat says the code was internal-only and never reached customers; any pipeline that installed a poisoned version should rotate its secrets.