DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware(github.com)

367 points by tosh 1 year ago | 263 comments

GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.

RCE Vulnerability in React and Next.js(github.com)

559 points by rayhaanj 10 months ago | 214 comments

GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.

Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884)(github.com)

23 points by ringzeropirate 4 months ago | 12 comments

Malicious litellm_init.pth in litellm 1.82.8 PyPI package – credential stealer(github.com)

701 points by theanonymousone 7 months ago | 281 comments

GitHub issue in BerriAI/litellm reporting a malicious litellm_init.pth file in the 1.82.8 PyPI package that steals credentials via a supply chain compromise.

Trivy ecosystem supply chain briefly compromised(github.com)

76 points by batch12 7 months ago | 23 comments

You too can run malware from NPM (I mean without consequences)(github.com)

180 points by naugtur 1 year ago | 102 comments

GitHub has not removed malicious imitation software after 3 weeks(successfulsoftware.net)

215 points by hermitcrab 1 month ago | 89 comments

A Successful Software blog post complaining that GitHub has not removed malicious software imitating the author's product three weeks after it was reported.

GitHub is investigating unauthorized access to their internal repositories(twitter.com)

527 points by splenditer 5 months ago | 289 comments

A post on X from GitHub stating it is investigating unauthorized access to its internal repositories, with no current evidence of impact to customer data.

RCE Vulnerability in React and Next.js(github.com)

559 points by rayhaanj 10 months ago | 214 comments

GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.

GitHub confirms breach of 3,800 repos via malicious VSCode extension(bleepingcomputer.com)

985 points by Timofeibu 5 months ago | 430 comments

BleepingComputer news article reporting that GitHub confirmed a breach of about 3,800 internal repositories via a malicious VSCode extension.

New Linux udisks flaw lets attackers get root on major Linux distros(bleepingcomputer.com)

336 points by smig0 1 year ago | 227 comments

BleepingComputer news article about a udisks vulnerability that lets attackers gain root privileges on major Linux distributions.

I'm being cyberattacked by Tesla, Inc(dreamstation.systems)

389 points by robinpie 1 month ago | 109 comments

Personal blog post describing persistent attack traffic in nginx logs from IPs with Host/Referer headers pointing to pool-ntp.tesla.com.