Thousands of secrets such as PyPI and AWS keys, GitHub tokens, and more, were stolen recently during a supply-chain attack ...

A new supply chain attack on GitHub, dubbed 'GhostAction,' has compromised 3,325 secrets, including PyPI, npm, DockerHub, ...

Hackers planted malicious code in open source software packages with more than 2 billion weekly updates in what is likely to ...

Attackers abused GitHub Actions workflows to siphon off thousands of credentials from hundreds of npm and PyPI repositories.

Investigations into the Nx "s1ngularity" NPM supply chain attack have unveiled a massive fallout, with thousands of account ...

The breach, now known to have begun in March, raises questions about why it took six months for Salesloft to detect the ...

A supply chain attack involving malicious GitHub Action workflows has impacted hundreds of repositories and thousands of ...

Google-owned Mandiant, which began an investigation into the incident, said the threat actor, tracked as UNC6395, accessed ...

Threat actors had access to Salesloft’s GitHub account between March and June 2025 and performed reconnaissance.

The explosion of non-human identities in cloud environments has created a blind spot that posture management tools can’t close. While these platforms excel at catching misconfigurations, they miss the ...

Build artifacts generated by GitHub Actions often contain access tokens that can be abused by attackers to push malicious code into projects or compromise cloud infrastructure.