Credential-Stealing GitHub Actions Workflows Found in Thousands of Repos
Attackers compromised open-source maintainer accounts to plant malicious GitHub Actions workflows stealing credentials in over 340 repositories.
Tag
#Open Source Security
3 results in the archive.
Malicious npm Packages Evade Install-Script Defenses at Runtime
Threat actors are using the 'indexed-btree' npm package to bypass supply chain defenses by hiding malicious code in runtime behavior rather than installation scripts, complicating detection.
Amazon Attributes Debug and Chalk NPM Supply Chain Attacks to North Korean Hackers
Amazon attributes multiple supply chain attacks on the Debug and Chalk npm packages to North Korean state-sponsored hackers, exposing risks to open-source software security.