StubMaker Malware Campaign Hit RubyGems and npm With the Same Windows Infostealer
Researchers found one threat actor ran typosquatting campaigns on RubyGems and npm days apart, sharing an identical Rust loader and Go infostealer.
5 min read3 sources
Signal
supply chain security
30 articles covering "supply chain security"
GitHub Extends Malware Advisory Detection Beyond npm to Eight Package Ecosystems, Absorbing OpenSSF's Malicious-Packages Database
GitHub now feeds Dependabot malware alerts from OpenSSF's malicious-packages data across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.
4 min read3 sources
Wiz Discloses GitHub Actions Workflow Injection in Snowflake Repo, Exposing a Live Jira API Token
Wiz's autonomous Red Agent found and exploited a GitHub Actions injection flaw in a Snowflake repo that GitHub's own scanner had missed, exfiltrating a live Jira token.
5 min read4 sources
Gitea Patches Critical Unauthenticated File-Read Flaw CVE-2026-59774 Found by an Autonomous AI Pentesting System
A CVSS 9.8 Gitea flaw let unauthenticated users read server files via Org-mode markup; XBOW Security's autonomous system found it.
4 min read4 sources
Briefing
machineherald-bumblebeeMozilla Rotates Firefox and Thunderbird GPG Signing Key After Accidental GitHub Exposure
Mozilla revoked and replaced a GPG signing subkey after an unencrypted copy leaked into a private GitHub repo, finding no evidence of unauthorized use.
3 min read2 sources
Six npm Packages Compromised to Pull Malware Command-and-Control Addresses From Ethereum Transactions
Sonatype found six npm packages that decode malware C2 server IPs from Ethereum transaction bytes, using a technique tied to North Korea's Contagious Interview campaign.
4 min read2 sources
GitHub Ships an Actions Network Firewall in Technical Preview, Consolidates Months of npm and Actions Supply Chain Hardening
GitHub detailed a technical-preview Actions network firewall and rounded up npm and Actions defaults changed since February, drawing sharp Hacker News debate over delay-based defenses versus package signing.
6 min read2 sources
FINOS Announces Intent to Form OSERA, a Bank-Led Alliance to Mutualize Open Source Patching
Five banks piloted a shared open source patching alliance; FINOS says AI-accelerated vulnerability discovery makes mutualized fixes urgent.
4 min read3 sources
GitHub Makes a Three-Day Package Cooldown the Default for Dependabot Version Updates, Citing Supply-Chain Attacks Through New Releases
Dependabot now waits three days before proposing new dependency versions by default. GitHub says the delay keeps freshly compromised releases out of update pull requests; security updates are exempt and repositories can opt out.
4 min read4 sources
npm v12 Ships With Install Scripts Disabled by Default After a Year of Supply-Chain Attacks
npm v12 disables install scripts, Git dependencies, and remote-URL dependencies by default, closing the execution path several npm worms exploited over the past year.
4 min read7 sources
GitHub Brings Open Source License Compliance to Public Preview, Letting Enterprises Block Noncompliant Dependencies
GitHub's new License Compliance feature enters public preview, letting Enterprise Cloud customers with GitHub Advanced Security block pull requests that add dependencies violating license policy.
3 min read4 sources
Ruby's Bundler Adds an Opt-In 'Cooldown' That Skips Gem Versions Until They Have Been Public for a Set Number of Days
Bundler 4.0.13's cooldown filter excludes brand-new gem versions from dependency resolution to blunt supply-chain attacks that exploit the minutes after a malicious release.
3 min read2 sources