Posts tagged with #github actions

A critical supply chain attack has rocked the open-source ecosystem, leveraging a subtle GitHub Actions misconfiguration to compromise hundreds of npm packages. The 'mini shy hulude' worm bypassed traditional security measures, leading to widespread infection and unprecedented persistence mechanisms.

A sophisticated supply chain attack, initially targeting TanStack packages, leveraged GitHub Actions cache poisoning and OIDC token exfiltration to spread malicious code across the NPM and Python ecosystems. Learn how this worm-like malware operates and critical steps to protect your development environment.