Cybersecurity articles tagged #GitHub on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attackshttps://runtimerebel.com/blog/teampcp-hackers-arrested-in-australia-over-supply-chain-attacksAustralian Federal Police arrest two men linked to TeamPCP, a cybercrime syndicate behind major software supply chain attacks and data extortion.Tue, 01 Sep 2026 02:41:36 GMTTeamPCPSupply Chain AttackShai HuludGitHubLiteLLMhttps://runtimerebel.com/blog/github-and-pypi-policy-updates-target-supply-chain-securityhttps://runtimerebel.com/blog/github-and-pypi-policy-updates-target-supply-chain-securityGitHub and PyPI introduce new restrictions to thwart supply chain attacks, including a Dependabot cooldown and limits on historical package file uploads.Mon, 27 Jul 2026 14:40:00 GMTGitHubPyPISupply Chain SecurityDependabotOpen Sourcehttps://runtimerebel.com/blog/github-dependabot-3-day-cooldown-mitigating-supply-chain-attackshttps://runtimerebel.com/blog/github-dependabot-3-day-cooldown-mitigating-supply-chain-attacksGitHub introduces a 3-day cooldown for Dependabot to prevent the rapid adoption of malicious packages, enhancing supply chain security for developers.Mon, 27 Jul 2026 11:25:20 GMTGitHubDependabotSupply Chain SecurityMalicious PackagesOpen Sourcehttps://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attackshttps://runtimerebel.com/blog/github-and-pypi-time-based-defenses-against-supply-chain-attacksGitHub and PyPI introduce time-based delays in Dependabot to mitigate supply chain attacks by preventing the immediate ingestion of malicious packages.Sun, 26 Jul 2026 17:03:02 GMTGitHubPyPIDependabotSupply Chain SecurityPythonhttps://runtimerebel.com/blog/github-adjusts-bug-bounty-impact-on-vulnerability-disclosurehttps://runtimerebel.com/blog/github-adjusts-bug-bounty-impact-on-vulnerability-disclosureGitHub is halving public bug bounty payouts and shifting top rewards to an invite-only VIP program, impacting vulnerability research and disclosure.Wed, 22 Jul 2026 21:11:24 GMTGitHubBug BountyVulnerability DisclosureSecurity ResearchSoftware Supply Chainhttps://runtimerebel.com/blog/fakegit-campaign-leverages-7600-github-repos-to-distribute-smartloader-stealchttps://runtimerebel.com/blog/fakegit-campaign-leverages-7600-github-repos-to-distribute-smartloader-stealcAnalysis of the FakeGit campaign distributing SmartLoader and StealC malware via over 7,600 deceptive GitHub repositories, impacting millions of downloads.Wed, 22 Jul 2026 02:46:33 GMTFakeGitSmartLoaderStealCGitHubSupply Chain AttackTyposquattingMalware Distributionhttps://runtimerebel.com/blog/fakegit-campaign-exploits-github-for-smartloader-malwarehttps://runtimerebel.com/blog/fakegit-campaign-exploits-github-for-smartloader-malwareAnalysis of the FakeGit campaign leveraging 7,600 GitHub repositories, including AI/MCP lures, to distribute SmartLoader malware. Learn detection and mitigation.Mon, 20 Jul 2026 21:13:10 GMTFakeGitSmartLoaderGitHubMalwareSupply Chain AttackSocial EngineeringSoftware Supply Chainhttps://runtimerebel.com/blog/malicious-github-repositories-infostealer-distribution-threathttps://runtimerebel.com/blog/malicious-github-repositories-infostealer-distribution-threatThreat actors are leveraging nearly 300 fake GitHub repositories, impersonating legitimate software, to distribute infostealer malware.Tue, 14 Jul 2026 21:03:07 GMTGitHubInfostealerMalware DistributionSupply Chain AttackSoftware Impersonationhttps://runtimerebel.com/blog/cisa-github-leak-lessons-from-aws-govcloud-credential-exposurehttps://runtimerebel.com/blog/cisa-github-leak-lessons-from-aws-govcloud-credential-exposureAnalysis of CISA's recent GitHub leak, detailing the exposure of AWS Govcloud keys and internal credentials, and providing critical lessons for cloud security.Mon, 13 Jul 2026 17:59:58 GMTCISAGitHubAWS GovCloudData LeakCloud SecurityCredential ExposureSecrets Managementhttps://runtimerebel.com/blog/github-api-abuse-detecting-ghost-account-reconnaissance-campaignshttps://runtimerebel.com/blog/github-api-abuse-detecting-ghost-account-reconnaissance-campaignsThreat actors are leveraging thousands of ghost accounts to map GitHub organizations via API abuse, facilitating future targeted supply chain attacks.Sat, 11 Jul 2026 20:51:29 GMTGitHubAPI SecurityReconnaissanceGhost Accountshttps://runtimerebel.com/blog/github-api-abuse-attackers-map-corporate-orgs-via-dormant-accountshttps://runtimerebel.com/blog/github-api-abuse-attackers-map-corporate-orgs-via-dormant-accountsDatadog Security Labs warns of systematic GitHub API enumeration campaigns using dormant accounts and compromised OAuth tokens to map corporate organizations.Thu, 09 Jul 2026 21:25:09 GMTGitHubAPI AbuseReconnaissanceOAuth TokenSupply ChainDatadoghttps://runtimerebel.com/blog/cordyceps-ci-cd-flaws-supply-chain-attacks-on-github-repositorieshttps://runtimerebel.com/blog/cordyceps-ci-cd-flaws-supply-chain-attacks-on-github-repositoriesNovee Security uncovered Cordyceps, a critical CI/CD workflow flaw exposing over 300 GitHub repositories to supply chain compromise, affecting major organizations.Wed, 24 Jun 2026 16:50:14 GMTCordycepsCI CDGitHubSupply Chain AttackNovee SecurityRepository Compromisehttps://runtimerebel.com/blog/novo-nordisk-breach-securing-secrets-in-github-development-pipelineshttps://runtimerebel.com/blog/novo-nordisk-breach-securing-secrets-in-github-development-pipelinesAnalysis of the Novo Nordisk GitHub token leak and why secrets management must transition from static tools to identity-based security frameworks.Fri, 19 Jun 2026 09:48:31 GMTGitHubSecrets ManagementNovo NordiskDevSecOpsCI CD Securityhttps://runtimerebel.com/blog/github-to-disable-npm-install-scripts-by-default-in-version-12https://runtimerebel.com/blog/github-to-disable-npm-install-scripts-by-default-in-version-12GitHub announces breaking changes for npm v12, disabling install scripts by default to prevent malicious code execution and enhance supply chain security.Thu, 11 Jun 2026 09:37:20 GMTNPMGitHubNpm V12Supply Chain SecurityMalware Preventionhttps://runtimerebel.com/blog/miasma-worm-source-code-briefly-leaked-on-githubhttps://runtimerebel.com/blog/miasma-worm-source-code-briefly-leaked-on-githubAnalysis of the Miasma worm source code leak on GitHub, a credential-stealing framework targeting open-source ecosystems via supply-chain attacks.Wed, 10 Jun 2026 20:58:55 GMTMiasmaWormCredential StealingSupply Chain AttackGitHubOpen Source Securityhttps://runtimerebel.com/blog/github-supply-chain-disruption-microsoft-repos-abused-to-host-malwarehttps://runtimerebel.com/blog/github-supply-chain-disruption-microsoft-repos-abused-to-host-malwareGitHub recently disabled 73 official Microsoft repositories after they were targeted in a massive campaign pushing password-stealing malware to developers.Tue, 09 Jun 2026 17:00:46 GMTGitHubMicrosoftSupply Chain AttackInfostealerDevSecOpshttps://runtimerebel.com/blog/miasma-compromises-73-microsoft-github-repos-incident-analysishttps://runtimerebel.com/blog/miasma-compromises-73-microsoft-github-repos-incident-analysisMicrosoft restores some GitHub repositories after 73 projects were hit by Miasma's supply chain attack to inject information stealers. Learn detection steps.Tue, 09 Jun 2026 17:00:07 GMTGitHubMiasmaMicrosoftSupply Chain AttackInformation StealerOpen Source Securityhttps://runtimerebel.com/blog/vs-code-one-click-github-token-theft-via-uri-handler-exploitationhttps://runtimerebel.com/blog/vs-code-one-click-github-token-theft-via-uri-handler-exploitationA flaw in Visual Studio Code allows attackers to steal GitHub authentication tokens with a single click. Learn the technical details and mitigation steps.Thu, 04 Jun 2026 09:26:58 GMTVisual Studio CodeGitHubToken TheftURI HandlerSocial Engineeringhttps://runtimerebel.com/blog/github-dev-one-click-attack-stealing-oauth-tokens-via-vs-codehttps://runtimerebel.com/blog/github-dev-one-click-attack-stealing-oauth-tokens-via-vs-codeNew research reveals a one-click exploit in GitHub.dev and VS Code that allows attackers to steal full GitHub OAuth tokens and access private repositories.Wed, 03 Jun 2026 13:47:14 GMTGitHubVS CodeOauth TheftURI Handlerhttps://runtimerebel.com/blog/megalodon-malware-github-repo-compromise-secret-thefthttps://runtimerebel.com/blog/megalodon-malware-github-repo-compromise-secret-theftAnalysis of the Megalodon malware campaign, which compromised over 5,500 GitHub repositories in six hours to steal developer credentials and sensitive secrets.Tue, 26 May 2026 20:47:15 GMTMegalodon MalwareGitHubSupply Chain AttackDeveloper SecretsCredential TheftRepository Compromisehttps://runtimerebel.com/blog/teampcp-supply-chain-attack-targets-microsoft-sdks-and-githubhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-targets-microsoft-sdks-and-githubTeamPCP expands its supply chain campaign to trojanize official Microsoft Python SDKs and infiltrate GitHub, requiring immediate dependency audits.Mon, 25 May 2026 16:52:00 GMTTeamPCPSupply Chain AttackPython SDKGitHubPyPINPMhttps://runtimerebel.com/blog/megalodon-supply-chain-attack-infects-5500-github-repositorieshttps://runtimerebel.com/blog/megalodon-supply-chain-attack-infects-5500-github-repositoriesAttackers used automated commits to inject malicious GitHub Actions workflows into 5,500+ repositories, targeting CI/CD secrets and sensitive tokens.Mon, 25 May 2026 09:28:56 GMTGitHubSupply Chain AttackMegalodonGitHub ActionsCredential Thefthttps://runtimerebel.com/blog/packagist-supply-chain-attack-8-packages-deliver-linux-malwarehttps://runtimerebel.com/blog/packagist-supply-chain-attack-8-packages-deliver-linux-malwareSecurity researchers identified a supply chain attack on Packagist involving eight infected packages that deploy Linux malware via GitHub Releases URLs.Sat, 23 May 2026 20:22:18 GMTPackagistComposerLinux MalwareSupply Chain AttackGitHubhttps://runtimerebel.com/blog/npm-staged-publishing-new-2fa-controls-prevent-supply-chain-attackshttps://runtimerebel.com/blog/npm-staged-publishing-new-2fa-controls-prevent-supply-chain-attacksGitHub introduces staged publishing for npm, requiring manual 2FA approval for package releases to mitigate malicious automated updates and account takeovers.Sat, 23 May 2026 20:21:54 GMTNPMGitHubSupply Chain SecurityTwo Factor AuthenticationStaged PublishingApplication Securityhttps://runtimerebel.com/blog/cisa-contractor-leaks-aws-govcloud-credentials-via-github-repositoryhttps://runtimerebel.com/blog/cisa-contractor-leaks-aws-govcloud-credentials-via-github-repositoryA significant security leak involving a CISA contractor has exposed privileged AWS GovCloud credentials and internal software deployment processes on GitHub.Sat, 23 May 2026 00:55:30 GMTCISAAWS GovCloudGitHubCredential LeakSupply Chainhttps://runtimerebel.com/blog/cisa-data-leak-aws-govcloud-keys-exposed-via-public-github-repohttps://runtimerebel.com/blog/cisa-data-leak-aws-govcloud-keys-exposed-via-public-github-repoLawmakers demand answers from CISA after a contractor leaked AWS GovCloud keys and internal secrets on GitHub, prompting urgent credential rotation.Fri, 22 May 2026 16:50:37 GMTCISAAWS GovCloudGitHubCredential ExposureInsider Threathttps://runtimerebel.com/blog/github-data-breach-analysis-of-teampcp-internal-repository-thefthttps://runtimerebel.com/blog/github-data-breach-analysis-of-teampcp-internal-repository-theftGitHub confirms the theft of 4,000 internal repositories by threat actor TeamPCP. Learn the technical implications and defense strategies for security teams.Thu, 21 May 2026 09:16:24 GMTGitHubTeamPCPSource Code TheftInternal RepositoriesData Exfiltrationhttps://runtimerebel.com/blog/github-repository-breach-linked-to-tanstack-supply-chain-attackhttps://runtimerebel.com/blog/github-repository-breach-linked-to-tanstack-supply-chain-attackGitHub confirms the breach of 3,800 internal repositories via a compromised VS Code extension linked to the TanStack npm supply chain attack.Thu, 21 May 2026 09:15:44 GMTGitHubTanStackNPMSupply Chain AttackVS Codehttps://runtimerebel.com/blog/github-internal-repositories-breached-via-nx-console-vs-code-extensionhttps://runtimerebel.com/blog/github-internal-repositories-breached-via-nx-console-vs-code-extensionGitHub confirms internal repository breach after an employee device was compromised by a poisoned Nx Console VS Code extension in a supply chain attack.Thu, 21 May 2026 05:31:21 GMTGitHubNx ConsoleVscode ExtensionsSupply Chain AttackNrwl Angular Consolehttps://runtimerebel.com/blog/github-repository-breach-3800-repos-accessed-via-vs-code-extensionhttps://runtimerebel.com/blog/github-repository-breach-3800-repos-accessed-via-vs-code-extensionGitHub confirms a security incident where a malicious VS Code extension compromised an employee account, leading to the unauthorized access of 3,800 repos.Wed, 20 May 2026 09:15:55 GMTGitHubVS CodeSupply Chain AttackCredential TheftDeveloper Securityhttps://runtimerebel.com/blog/github-internal-repo-breach-claimed-by-teampcp-code-at-riskhttps://runtimerebel.com/blog/github-internal-repo-breach-claimed-by-teampcp-code-at-riskGitHub investigates TeamPCP's claim of breaching internal repositories, potentially exposing 4,000 private codebases. Defenders must secure supply chains.Wed, 20 May 2026 05:27:49 GMTGitHubTeamPCPData BreachSupply ChainSource Codehttps://runtimerebel.com/blog/github-investigates-claimed-teampcp-breach-of-4000-internal-reposhttps://runtimerebel.com/blog/github-investigates-claimed-teampcp-breach-of-4000-internal-reposGitHub is investigating a potential breach of 4,000 internal repositories claimed by TeamPCP, highlighting the risk of source code leaks for enterprises.Wed, 20 May 2026 05:27:11 GMTGitHubTeamPCPSource Code LeakData BreachCybercrimehttps://runtimerebel.com/blog/cisa-github-repo-exposes-secrets-credentials-in-public-viewhttps://runtimerebel.com/blog/cisa-github-repo-exposes-secrets-credentials-in-public-viewCISA inadvertently exposed sensitive secrets and credentials within a publicly accessible GitHub repository.Tue, 19 May 2026 20:42:19 GMTCISAGitHubData ExposureCredentialsSecrets ManagementCloud Security Misconfigurationhttps://runtimerebel.com/blog/cisa-contractor-leaked-aws-govcloud-keys-on-github-critical-exposurehttps://runtimerebel.com/blog/cisa-contractor-leaked-aws-govcloud-keys-on-github-critical-exposureA CISA contractor publicly exposed highly privileged AWS GovCloud and internal system credentials on GitHub, detailing CISA's software development.Tue, 19 May 2026 00:57:26 GMTCISAAWS GovCloudGitHubData LeakCredentialsGovernment SecuritySupply Chainhttps://runtimerebel.com/blog/grafana-github-token-compromise-codebase-stolen-via-pathttps://runtimerebel.com/blog/grafana-github-token-compromise-codebase-stolen-via-patGrafana Labs reports a source code breach after attackers leveraged a stolen GitHub Personal Access Token. Analysis of the impact and mitigation steps.Mon, 18 May 2026 17:03:57 GMTGrafanaGitHubCredential TheftSource Code ExfiltrationSupply Chain Securityhttps://runtimerebel.com/blog/grafana-github-token-leak-codebase-access-and-extortion-attempthttps://runtimerebel.com/blog/grafana-github-token-leak-codebase-access-and-extortion-attemptGrafana discloses a security incident where an unauthorized party used a GitHub token to download source code, leading to a failed extortion attempt.Sun, 17 May 2026 08:48:24 GMTGrafanaGitHubToken LeakCodebase TheftExtortionhttps://runtimerebel.com/blog/github-high-severity-bug-discovered-via-ai-reverse-engineeringhttps://runtimerebel.com/blog/github-high-severity-bug-discovered-via-ai-reverse-engineeringWiz utilized AI reverse-engineering to uncover a high-severity vulnerability within GitHub, demonstrating advanced discovery methods for complex bugs.Wed, 29 Apr 2026 20:32:08 GMTGitHubApplication SecurityAI in SecurityVulnerability DiscoveryReverse EngineeringWizhttps://runtimerebel.com/blog/checkmarx-supply-chain-attack-github-data-exfiltration-confirmedhttps://runtimerebel.com/blog/checkmarx-supply-chain-attack-github-data-exfiltration-confirmedCheckmarx confirms data exfiltration from its GitHub environment following a malicious code publication. Learn about the TTPs and mitigation strategies.Wed, 29 Apr 2026 12:42:21 GMTCheckmarxGitHubSupply Chain AttackData BreachMalicious Packageshttps://runtimerebel.com/blog/cve-2026-3854-github-rce-via-malicious-git-push-commandhttps://runtimerebel.com/blog/cve-2026-3854-github-rce-via-malicious-git-push-commandA critical command injection vulnerability, CVE-2026-3854, allows authenticated users to achieve RCE on GitHub instances via a single git push operation.Tue, 28 Apr 2026 20:33:48 GMTCVE-2026-3854GitHubGitHub Enterprise ServerRCECommand Injectionhttps://runtimerebel.com/blog/checkmarx-github-repository-data-leaked-following-supply-chain-attackhttps://runtimerebel.com/blog/checkmarx-github-repository-data-leaked-following-supply-chain-attackCheckmarx confirms internal GitHub repository data was published on the dark web following a March 2026 supply chain incident. Learn the impact and TTPs.Mon, 27 Apr 2026 16:37:34 GMTCheckmarxGitHubSupply Chain AttackData LeakDevSecOpshttps://runtimerebel.com/blog/ai-assisted-supply-chain-attack-targets-github-misconfigurationshttps://runtimerebel.com/blog/ai-assisted-supply-chain-attack-targets-github-misconfigurationsAnalysis of the AI-assisted PRT-scan supply chain attack targeting GitHub misconfigurations. Learn about automated threats and securing repositories.Tue, 07 Apr 2026 00:41:26 GMTPRT ScanGitHubAISupply Chain AttackMisconfigurationhttps://runtimerebel.com/blog/fake-github-repositories-deliver-vidar-infostealer-via-claude-leakhttps://runtimerebel.com/blog/fake-github-repositories-deliver-vidar-infostealer-via-claude-leakThreat actors are exploiting the Claude Code leak, deploying fake GitHub repositories to distribute Vidar infostealer malware, targeting unsuspecting developers and…Fri, 03 Apr 2026 00:39:40 GMTClaude CodeGitHubVidar InfostealerMalwareSupply Chain Attackhttps://runtimerebel.com/blog/openai-codex-vulnerability-exposed-github-tokens-via-oauth-flawhttps://runtimerebel.com/blog/openai-codex-vulnerability-exposed-github-tokens-via-oauth-flawResearchers discovered a critical OpenAI Codex vulnerability allowing GitHub token theft via OAuth flaws, risking unauthorized access to private repositories.Tue, 31 Mar 2026 08:32:36 GMTOpenAICodexGitHubOAuthCredential Thefthttps://runtimerebel.com/blog/openai-patches-chatgpt-data-exfiltration-and-codex-token-flawshttps://runtimerebel.com/blog/openai-patches-chatgpt-data-exfiltration-and-codex-token-flawsOpenAI addresses high-impact vulnerabilities in ChatGPT and Codex that enabled unauthorized data exfiltration and exposure of sensitive GitHub tokens.Mon, 30 Mar 2026 20:17:42 GMTOpenAIChatGPTCodexData ExfiltrationCheck PointGitHubhttps://runtimerebel.com/blog/gitguardian-2026-report-analyzing-the-34-surge-in-secrets-sprawlhttps://runtimerebel.com/blog/gitguardian-2026-report-analyzing-the-34-surge-in-secrets-sprawlGitGuardian's 2026 report reveals 29 million leaked secrets on GitHub in 2025. Learn how AI and hardcoded credentials impact enterprise security posture.Mon, 30 Mar 2026 12:26:38 GMTGitGuardianSecrets SprawlGitHubDevSecOpsHard Coded Credentialshttps://runtimerebel.com/blog/github-malware-campaign-fake-vs-code-alerts-target-developershttps://runtimerebel.com/blog/github-malware-campaign-fake-vs-code-alerts-target-developersAttackers exploit GitHub Discussions to push malware via fake VS Code security alerts. Learn the TTPs used to target developers and how to mitigate risk.Fri, 27 Mar 2026 20:15:23 GMTGitHubVisual Studio CodePhishingMalwareInfostealerDeveloper Securityhttps://runtimerebel.com/blog/github-copilot-autofix-ai-driven-vulnerability-remediation-in-ghashttps://runtimerebel.com/blog/github-copilot-autofix-ai-driven-vulnerability-remediation-in-ghasGitHub integrates AI-powered scanning into Advanced Security to detect and remediate vulnerabilities across more languages using Copilot Autofix.Thu, 26 Mar 2026 00:39:20 GMTGitHubAI SecurityCopilot AutofixVulnerability ManagementCode Scanninghttps://runtimerebel.com/blog/malicious-github-openclaw-deployer-repos-deliver-trojanshttps://runtimerebel.com/blog/malicious-github-openclaw-deployer-repos-deliver-trojansAnalysts uncover an AI-assisted campaign using over 300 poisoned GitHub repositories like OpenClaw Deployer to distribute infostealers to developers.Tue, 24 Mar 2026 16:30:07 GMTGitHubOpenClawInfostealerSupply Chain AttackAi Assisted Threatshttps://runtimerebel.com/blog/forcememo-credential-theft-compromises-python-repositorieshttps://runtimerebel.com/blog/forcememo-credential-theft-compromises-python-repositoriesResearchers reveal ForceMemo, a campaign exploiting credentials stolen via GlassWorm to compromise hundreds of GitHub accounts and Python repositories.Mon, 16 Mar 2026 12:24:53 GMTForceMemoGlassWormGitHubPythonSupply Chain AttackCredential Thefthttps://runtimerebel.com/blog/over-100-github-repositories-distributing-boryptgrab-stealerhttps://runtimerebel.com/blog/over-100-github-repositories-distributing-boryptgrab-stealerA large-scale campaign on GitHub utilizes over 100 repositories to distribute BoryptGrab, an info-stealer targeting crypto wallets and browser data.Sat, 07 Mar 2026 16:09:43 GMTBoryptGrabGitHubInfostealerPythonMalware Campaign