Source
7 articles citing this source
Aikido and StepSecurity say stolen GitHub credentials have pushed a CI secret stealer since November 10; their counts differ and no cited source says how the credentials were obtained.
GitHub's November 2 changelog says Actions will block pull_request_target by default in public repositories from December 2, 2026, after brownouts on November 9 and 16, unless an event policy allows it.
Comparing three October 2026 cases, GhostAction, the OVHcloud CLI release swap and npm's SlugFest trusted-publishing gap, on how accounts, names and release settings were exploited.
StepSecurity says two hijacked maintainer accounts, including Uber athenadriver's author, pushed a credential-stealing workflow to 345 repositories on October 8; Socket counts 500+ accounts.
StepSecurity and Socket report that tensorlake@0.5.144 on npm steals credentials and AI-tool configs, and installs a monitor that deletes files if a stolen GitHub token is revoked.
Microsoft attributes the June 17 compromise of 140-plus Mastra npm packages to North Korean state actor Sapphire Sleet, which used a hijacked maintainer account to inject a malicious dayjs typosquat called easy-day-js.
A self-spreading npm worm called Miasma published Trojanized packages carrying valid-looking SLSA provenance, beginning with 32 @redhat-cloud-services releases on June 1.