Public secrets exposure leads to supply chain attack on GitHub CodeQL(praetorian.com)

285 points by cyberbender 1 year ago | 53 comments

A GitHub Issue Title Compromised 4k Developer Machines(grith.ai)

588 points by edf13 7 months ago | 181 comments

Blog post from grith.ai describing the "Clinejection" attack chain, where a prompt injection in a GitHub issue title led to a supply chain compromise of about 4,000 developer machines.

Kaspersky exposes hidden malware on GitHub stealing personal data(kaspersky.com)

154 points by 01-_- 1 year ago | 84 comments

GitHub Spam(djanes.xyz)

120 points by bl4ckneon 2 years ago | 69 comments

Ghrc.io appears to be malicious(bmitch.net)

352 points by todsacerdoti 1 year ago | 58 comments

Blog post by Brandon Mitchell reporting that ghrc.io, a typo of GitHub's ghcr.io container registry, appears to steal GitHub credentials.

NixOS and reproducible builds could have detected the xz backdoor(luj.fr)

260 points by birdculture 1 year ago | 112 comments