Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
13 / 55 results
highbug_reportVulnerabilityGhostAction supply chain attack expands to 94 repos with credential stealer
94 GitHub repositories across 66 owners compromised. Targets open-source developers using GitHub Actions, VS Code, and OAuth device flows. Malware disguised as font file (fa-solid-400.woff2) steals AWS keys, PyPI/npm tokens, Git credentials, Kubernet…
highbug_reportVulnerabilitynpm trusted publishing flaw enabled hijack of 1,500+ packages via slug reuse
npm packages using trusted publishing with GitHub Actions where the linked repository slug (owner/repository) has never completed a successful publish, or where repositories have been renamed, transferred, or deleted.
highperson_alertThreat ActorGhostAction Campaign Injects Credential-Stealing Workflows into 340+ Repos
GhostAction is a large-scale supply chain attack campaign first identified in September 2025, focused on compromising GitHub maintainer accounts to inject malicious GitHub Actions workflows.
highperson_alertThreat ActorFakeGit Campaign Reactivates with 17,610 Malicious GitHub Repositories
FakeGit is a coordinated malware distribution campaign that leverages fake GitHub repositories to deliver multiple malware families. The operation uses a combination of throwaway accounts and approximately 700 compromised legitimate developer account…
highbug_reportVulnerabilityCompromised GitHub Actions re-enabled with malicious code for 7+ days
Two third-party GitHub Actions previously compromised in Mini Shai-Hulud campaign. Specific action names not disclosed. Affects any workflows consuming these actions during the exposure window (7+ days).
highbug_reportVulnerabilityGitHub Actions repos re-enabled with Mini Shai-Hulud malware intact
Two GitHub Actions repositories (actions-cool/issues-helper and actions-cool/maintain-one-comment) compromised in May 2026. Any CI/CD workflows referencing these actions by version tags (e.g., v2.2.1 or later from May 18, 2026) executed malicious pay…
criticalbug_reportVulnerabilityGitHub Enterprise Server SSRF flaw enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). SSRF vulnerability CVE-2026-77987 affects on-premises GitHub Enterprise Server deployments.
criticalbug_reportVulnerabilityCritical SSRF in GitHub Enterprise Server enables remote code execution
GitHub Enterprise Server (specific versions not disclosed in available data). The vulnerability is an SSRF (Server-Side Request Forgery) flaw tracked as CVE-2026-77987.
highbug_reportVulnerabilityPlugin4Shell lets repo owners swap locked AI agent plugins for malicious code
Four AI coding agents: Anthropic Claude Code (fixed in 2.1.179), OpenAI Codex (fixed in 0.146.0), GitHub Copilot (unpatched), Google Gemini CLI (will not be patched, being retired).
highbug_reportVulnerabilityAI coding agents execute malicious Git config commands outside sandbox
Seven command-line AI coding agents: goose (fixed in 1.44.0), Codex CLI/Desktop (fixed in 0.131.0 / 26.519.x), Claude Code (partially fixed in 2.1.196, second path unpatched in 2.1.252+), Hermes Agent 0.18.2–0.21.0 (unpatched), Qwen Code 0.19.6–0.22.…
highbug_reportVulnerabilityChainDrop npm worm infects 400+ packages, steals secrets via blockchain C2
Over 400 npm packages including widely used packages like keyv and cacheable-request. Affects developer workstations, CI/CD pipelines (especially GitHub Actions), cloud environments, and downstream software users.
highperson_alertThreat ActorGitHub Actions Abused to Scan and Exploit cPanel/WHM Servers
The threat actor behind this campaign remains unattributed. The operation demonstrates sophisticated understanding of GitHub Actions infrastructure and supply chain attack vectors.
highperson_alertThreat ActorFakeGit Campaign Distributes Malware via 7,600 Malicious GitHub Repos
FakeGit is a threat actor conducting a large-scale supply chain attack campaign targeting the software development community. The actor's motivation centers on mass malware distribution through the compromise of developer trust in the GitHub platform…