OVHcloud CLI releases backdoored on GitHub to steal secrets
A hijacked contributor account swapped the binaries on OVHcloud CLI releases v0.11.0–v0.15.0 with secret-stealing builds. Clean release is v0.16.0. Rotate everything.
Stories tagged: #github
GhostAction hides a credential stealer in a fake font file
A second-stage stealer disguised as fa-solid-400.woff2 was planted in 94 GitHub repos, harvesting AWS, npm, SSH, and Claude/Gemini keys via a VS Code tasks.json trigger.
GitHub hardens npm trusted publishing after SlugFest flaw
GitHub tightened npm's trusted publishing after Bloom Security's 'SlugFest' showed claiming an abandoned repo slug could hijack 1,500+ packages. Unvalidated configs now expire in 48 hours.
GhostAction supply-chain attack returns, hits 340+ repos
The GhostAction campaign is back: malicious GitHub Actions workflows pushed to 340+ repos via two hijacked maintainer accounts, exfiltrating secrets to a hard-coded IP over plain HTTP.
Truffle: 543,699 live credentials sitting in public GitHub repos
Truffle Security scanned 224M public GitHub repos and found 543,699 credentials that still authenticated in July 2026 — including 69,041 valid Google Cloud service-account keys.
Anthropic patches Claude Code GitHub Action repo-takeover chain
GMO Flatt Security's RyotaK chained a checkWritePermissions bot bypass with prompt injection to hijack any public repo running claude-code-action. Fix shipped in v1.0.94.
VS Code github.dev zero-day exposed full GitHub OAuth tokens in one click
Researcher Ammar Askar dropped a webview-postMessage exploit on June 2 that steals github.dev OAuth tokens via a single click. Microsoft shipped a stopgap fix the next day.
CISA links GitHub repo exfiltration to malicious Nx Console 18.95.0
CISA's May 28 alert ties the 3,800-repo GitHub breach to a poisoned Nx Console VS Code extension. CVE-2026-48027 is in KEV. Federal deadline June 10.