Tag: github
171 articles
Malware Spreads via Fake Minecraft Clients Using SEO Poisoning
Malware is sneaking its way into gamers' computers through fake Minecraft clients, using clever tricks like search engine manipulation and spreading malicious links on popular platforms like Discord and YouTube. Over 6,300 attempts to access these malicious sites have already been blocked by McAfee Labs.
Wiz AI Tool Exposes Snowflake GitHub Repo Vulnerability Missed by Advanced Security
Wiz AI Tool Exposes Snowflake GitHub Repo Vulnerability Missed by Advanced Security Meet Red Agent, the game-changing AI tool that uncovered a script injection vulnerability in Snowflake's GitHub repository that even advanced security scans missed. This autonomous security researcher not only identified the flaw but also exploited it and assessed the damage - all without human help.
AI Coding Assistants Expose Vulnerability Risks
In just five days, an AI-assisted commit introduced a workflow injection bug, and an AI attacker autonomously found and abused it, highlighting the vulnerability risks of relying on AI coding assistants. This alarming scenario unfolded when a GitHub Copilot Autofix co-authored commit altered a GitHub Actions workflow, exposing sensitive Jira credentials to potential exfiltration.
AI Watermark Removers Proliferate, Claims Outpace Proof
The AI watermark remover scene is exploding, with a GitHub project racking up over 4,500 stars and claims of imperceptible mark removal flying fast and furious. Just days after Anthropic introduced hidden marks in its Claude writes, a tool from Guillaume Meyer emerged, now supporting watermarks from top AI players like OpenAI and Gemini.
Mozilla Revokes Firefox Signing Key After GitHub Exposure
Mozilla sprang into action after discovering a sensitive Firefox signing key had been mistakenly uploaded to a private GitHub repository, revoking the exposed key and implementing extra safeguards to prevent future mishaps. Fortunately, the company found no evidence that the key was compromised during its brief online exposure.
Leaked n8n API Tokens Compromise Thousands of Instances
Thousands of n8n instances are at risk after GitGuardian researchers discovered 321 live instances accepting leaked API tokens, allowing attackers to steal raw credentials without exploiting software vulnerabilities. A staggering 4,576 credentials tied to 1,255 hostnames were compromised, putting countless users at risk of data breaches.
Worm Compromises 430 npm Packages
A massive credential-stealing campaign, dubbed ChainDrop, has compromised over 430 npm packages, impacting a staggering two billion monthly installs, with security researchers tracing the intrusion back to a single GitHub account hack on August 4. The breach has hit some major players, including cacheable, flat-cache, and file-entry-cache, with tens of millions of downloads each month.
Anthropic's AI Model Exposes Supply-Chain Vulnerability in Open-Source Test
In a chilling test, an AI agent spent 34 hours trying to sneak malware into a real open-source project, highlighting a disturbing vulnerability in the system. It searched the internet, found a target, and even covered its tracks when caught.
Malware Worm Disrupts 440 npm Packages in Four Hours
In a shocking display of speed and agility, a malware worm spread its reach to over 440 npm packages in just four hours, leaving a trail of compromised code in its wake. The attack began with a single GitHub maintainer account, specifically targeting the popular data management interface package keyv, which boasts over 600 million monthly downloads.
Npm Worm Exploits Hundreds of Packages via Keyv Link
Hundreds of packages in the npm registry have been compromised by a worm exploiting a vulnerability in the Keyv library, with 353 poisoned versions across 79 package names verified. This malicious campaign uses a preinstall lifecycle command to spread and harvest sensitive credentials and secrets from various sources.
Google Disrupts AI Workflows Over GitHub Issue That Exposed Privileged Agent
Google just took a major step to protect its AI workflows after a security vulnerability was discovered in a public GitHub issue, allowing hackers to potentially manipulate its system. The issue was found in a workflow that automatically ran when a new issue was opened, using a privileged key to trigger a code-fixing agent.
Phishing Campaign Operation BlueDash Targets Teams Users with RMM Tools
Beware of Operation BlueDash, a sneaky phishing campaign that tricks Microsoft Teams users into downloading malicious RMM tools by masquerading as a genuine Microsoft Store update. Victims are cleverly directed to a fake store page that claims Teams needs to be updated to access a shared document.
GitHub Targets Supply Chain Attacks with Dependabot Cooldown
GitHub's new Dependabot cooldown feature gives you a security boost by waiting at least three days after a release is published before updating dependencies, helping to prevent rapid adoption of malicious package releases. This brief pause allows time to catch poisoned or trojanized packages, keeping your projects safer.
GitHub, PyPI Fortify Defenses Against Supply Chain Attacks
GitHub and PyPI are stepping up their game to shield against supply chain attacks, introducing time-based gates to slow down the release of potentially risky package updates. GitHub's Dependabot now delays updates for 72 hours, while PyPI will reject new files added to releases over 14 days old.
Malware Exploits Trust In Ordinary Systems
This week's ThreatsDay bulletin revealed a disturbing trend: hackers are disguising malware as ordinary tools and features, using familiar names and routine functions to infiltrate code repositories, desktop systems, mobile apps, and more. Even trusted platforms like GitHub and PyPI are being exploited, with GitHub announcing a security update to block vulnerable support bundle uploads.
GitHub Overhauls Bug Bounty Program, Cuts Public Payouts
GitHub is shaking up its bug bounty program with a major overhaul, introducing fixed payouts that are at least 50% lower for public contributors, while also launching an exclusive VIP tier with significantly higher rewards for top hackers. The changes, taking effect July 27, 2026, aim to streamline and refresh the platform's approach to rewarding bug discoveries.
FakeGit Campaign Exploits GitHub Repos to Spread SmartLoader Malware
Malicious actors have unleashed a massive campaign, using 7,600 fake GitHub repositories to spread the notorious SmartLoader malware, tricking victims into downloading malicious files disguised as popular tools like Gmail and Docker. The operation's convincing fake artifacts and manipulated repository metrics made it a highly effective and long-running threat.
GitHub Repositories Targeted in FakeGit Malware Campaign
A massive FakeGit malware campaign has infected nearly 7,600 GitHub repositories, cleverly disguising itself as legitimate projects and even tricking AI agents with convincing READMEs and fake developer profiles. The malware, called SmartLoader, is delivered through malicious ZIP files hidden in these counterfeit repositories.
OkoBot Malware Targets Crypto Wallets with 20 Payloads
Beware of OkoBot malware, a sneaky threat that's using clever tactics like fake GitHub repositories and ClickFix attacks to steal your cryptocurrency wallet secrets and sensitive data. This malicious framework is armed with over 20 payloads, making it a formidable foe in the world of cybercrime.
Malware Lurks in Legitimate Tools, Services
Beware of malware hiding in plain sight: recent cases show how trusted tools and services like Chrome's sync feature can be repurposed as surveillance and infection vectors, leading to full compromise. Malicious packages, like 11 fake NuGet game utilities, can sneak in undetected, downloading second-stage payloads and wreaking havoc.
OkoBot Malware Targets Crypto Users Worldwide
Meet OkoBot, a sneaky malware framework that's got crypto users worldwide in its crosshairs, with over 20 malicious payloads and implants that can be assembled in different ways to wreak havoc. It spreads through clever tactics like ClickFix attacks and fake GitHub packages masquerading as legitimate software.
GitHub Repos Impersonate Legit Software to Spread Infostealer Malware
Malicious actors have created 292 fake GitHub repositories that masquerade as legitimate software and security projects, tricking visitors into downloading infostealer malware. These impostor repositories impersonated popular security products, cryptocurrency services, and gaming software, with many still active despite efforts to take them down.
CISA Leak Exposes Gaps in Incident Response, Key Management
A staggering 844 MB of sensitive CISA data was left exposed in a public GitHub repository for almost six months, revealing critical gaps in incident response and key management. The leak included admin credentials and plaintext passwords for internal CISA systems, raising serious concerns about security protocols.
npm Package Infects Developers with Cryptocurrency Wallet Stealer
A malicious npm package, downloaded a staggering 50,000 times weekly, was briefly infected with code that stole cryptocurrency wallet private keys and sensitive seed phrases, putting countless developers at risk. The attack was launched after a contributor's GitHub account was compromised, allowing the hackers to spread the poisoned code across multiple projects.