#GitHub
All CosmicBytez Labs articles tagged #GitHub, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-105221: gist RubyGem Disables TLS Certificate Validation, Exposing GitHub OAuth Tokens
The gist RubyGem before 6.1.0 sets VERIFY_NONE on every HTTPS connection, letting on-path attackers intercept GitHub API traffic and steal OAuth tokens.
- News
ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
This week: an AI agent chained two Zammad zero-days to root in seconds, 543,699 live secrets sat exposed on GitHub, plus an Unsloth Studio model-inspection RCE.
- News
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Stolen OAuth token from May's TanStack npm worm let attackers clone 170 CrowdSec private repos, undetected for four months.
- News
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
A former employee's still-active GitHub token, compromised in May's TanStack npm attack, let a hacker copy 170 of CrowdSec's private repos.
- News
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repos for C2
Pakistan-aligned APT36 debuts RUSTYSHADE, a Rust backdoor using private GitHub repos for C2, targeting India and Afghanistan govt/defense.
- News
New GitHub, PyPI Policies Boost Supply Chain Security
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI now rejects file uploads to releases older than 14 days—two targeted...
- News
GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI have introduced time-based mechanisms in the Dependabot dependency management tool to protect against supply-chain attacks, limiting the...
- News
FakeGit Campaign Uses 7,600 GitHub Repos to Push SmartLoader Malware
A large-scale malware distribution operation called FakeGit has seeded 7,600 malicious GitHub repositories that collectively amassed over 14 million...
- Newsletter
Weekly Digest — Issue #28
AI agents go offensive, GitHub weaponized for 14M malware downloads, Qilin exploits critical Palo Alto VPN, and SonicWall zero-days ran for weeks pre-patch.
- News
Lessons Learned from CISA's Recent GitHub Leak
CISA has published a postmortem on a data leak in which a contractor exposed dozens of internal credentials — including AWS GovCloud keys — in a public...
- News
Ghost Accounts Abuse GitHub API in Mass Recon Campaign
Multiple threat campaigns are leveraging disposable 'ghost' GitHub accounts to conduct mass reconnaissance against organizations, systematically mapping...
- News
North Korean Hackers Target Open Source Developers in Supply Chain Attacks
The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer...
- News
Clean GitHub Repo Tricks AI Coding Agents Into Running Malware
Researchers demonstrate how a seemingly clean, scanner-safe GitHub repository can silently execute a malicious payload when an AI coding agent clones and...
- News
Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
Novee Security researchers have identified a critical exploitable CI/CD workflow pattern dubbed Cordyceps that enables attackers to hijack GitHub Actions...
- News
Novo Nordisk Breach Exposes Software Development Pipeline Risk
A leaked GitHub token at Novo Nordisk has exposed a fundamental flaw in how organizations approach secrets management — treating it as a tooling problem...
- News
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
GitHub has announced that npm version 12 will disable install scripts by default as a breaking change aimed at combating software supply chain attacks...
- News
The Miasma Worm Source Code Briefly Leaked on GitHub
The Miasma credential-stealing worm framework was briefly open-sourced on GitHub before removal, potentially enabling copycat attacks against open-source...
- News
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
Microsoft's GitHub presence has become the latest target of the self-replicating Miasma supply chain worm, with 73 repositories across Azure, Azure-Samples…
- News
VS Code Zero-Day Lets Hackers Steal GitHub Tokens in One Click
A security researcher has released exploit code for a Visual Studio Code zero-day vulnerability that allows attackers to steal GitHub authentication tokens by…
- News
Microsoft Says Zero-Day Public Releases Are 'Never Justifiable' as Researcher Threatens More Drops
Microsoft publicly condemned unauthorized zero-day disclosures as 'never justifiable' after a security researcher published working proof-of-concept...
- News
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal
Microsoft condemns uncoordinated public zero-day disclosure, urging the security community to adopt CVD after removing a researcher's GitHub account.
- News
Megalodon GitHub Attack Targets 5,561 Repos with Malicious
Cybersecurity researchers have uncovered Megalodon, an automated attack campaign that pushed 5,718 malicious commits to over 5,500 GitHub repositories in...
- News
Grafana Says Codebase and Other Data Stolen via TanStack
Grafana confirmed attackers stole internal source code and data after a GitHub token compromised in the TanStack npm supply chain attack was never...
- News
Laravel Lang Packages Hijacked to Deploy
A supply chain attack targeting Laravel Lang localization packages has exposed developers to credential-stealing malware after attackers abused GitHub...
- News
npm Adds 2FA-Gated Publishing and Package Install Controls
GitHub has rolled out new security controls for npm including staged publishing with 2FA approval requirements and package install policies, giving...
- News
GitHub Links Repo Breach to TanStack npm Supply-Chain Attack
GitHub has confirmed that hackers who stole 3,800 internal repositories gained access through a malicious version of the Nx Console VS Code extension...
- News
GitHub Breached — Employee Device Hack Led to Exfiltration
GitHub is investigating unauthorized access to thousands of internal repositories after an employee device was compromised through the TanStack npm supply...
- News
GitHub Confirms Being Hacked by TeamPCP, Says Customer Data
GitHub has officially confirmed it was breached by the TeamPCP threat actor after the group advertised stolen internal source code on a cybercrime forum....
- News
GitHub Confirms Breach, 4K Internal Repos Stolen
GitHub has confirmed a data breach in which the TeamPCP threat actor stole approximately 4,000 internal repositories. The company states no customer data...
- News
GitHub Investigating TeamPCP Claimed Breach of ~4,000
GitHub is investigating unauthorized access to its internal repositories after the TeamPCP threat actor listed approximately 4,000 GitHub internal repos...
- News
Grafana Breach Caused by Missed Token Rotation After
Grafana Labs has revealed that its May 2026 source code breach was caused by a single GitHub workflow token that was inadvertently missed during the token...
- News
Grafana GitHub Breach Exposes Source Code via TanStack npm
Grafana Labs confirms its GitHub environment was breached through the TanStack npm supply chain attack, exposing public and private source code...
- News
Grafana Confirms Breach After Hackers Claim They Stole Data
Grafana has confirmed a security breach after the Coinbase Cartel cybercrime group — linked to ShinyHunters, Scattered Spider, and Lapsus$ — claimed to...
- News
Grafana Says Stolen GitHub Token Let Hackers Steal Codebase
Grafana Labs confirmed that hackers downloaded its source code after breaching its GitHub environment using a stolen access token. The attackers attempted...
- News
Grafana GitHub Token Breach Led to Codebase Download and Extortion Attempt
Grafana has disclosed that an unauthorized party obtained a GitHub access token, used it to download the company's entire codebase, and then attempted...
- News
Critical GitHub Vulnerability Exposed Millions of Repositories
A critical remote code execution vulnerability, CVE-2026-3854, was found to impact GitHub.com and GitHub Enterprise Server, potentially exposing millions...
- News
GitHub Fixes RCE Flaw That Gave Access to Millions of Private Repos
GitHub has patched CVE-2026-3854, a critical remote code execution vulnerability exploitable via a single HTTP request that could have granted attackers...
- News
Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw
Cybersecurity researchers have disclosed a critical remote code execution vulnerability in GitHub.com and GitHub Enterprise Server that allows an...
- Newsletter
Apr 28 Digest: Medtronic 9M Breach, GitHub RCE, LiteLLM
ShinyHunters hits Medtronic and ADT in the same week, exposing millions of records; a critical one-push RCE lands in GitHub; LiteLLM's pre-auth SQL...
- News
Checkmarx Confirms GitHub Repository Data Posted on Dark
Checkmarx has confirmed that data from its GitHub repositories has been published on the dark web following an investigation into the March 23 supply...
- News
Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2
Zscaler ThreatLabz has uncovered a Tropic Trooper (APT23) campaign that delivers the AdaptixC2 post-exploitation beacon via trojanized SumatraPDF...
- News
Claude Code Leak Used to Push Infostealer Malware on GitHub
Threat actors are capitalising on the Claude Code source code leak by creating fake GitHub repositories that impersonate the leaked source to deliver...
- News
The State of Secrets Sprawl 2026: 9 Takeaways for CISOs
GitGuardian's State of Secrets Sprawl 2026 report found 29 million new hardcoded secrets in public GitHub repositories in 2025 alone — a 34%...
- News
GlassWorm ForceMemo: Stolen GitHub Tokens Used to Poison
The GlassWorm threat actor has launched a new sub-campaign called ForceMemo, using stolen GitHub tokens to silently force-push malware into hundreds of...
- News
UNC6426 Weaponizes Old nx npm Compromise to Seize AWS Admin Access
Threat actor UNC6426 leveraged stolen credentials from last year's nx npm supply chain attack to achieve full AWS administrator access at a victim...
- News
Russian APT 'ChainReaver' Hijacks 50 GitHub Accounts and Mirrors
A Russian state-sponsored APT group dubbed ChainReaver-L compromised trusted file-sharing mirrors and 50 long-established GitHub accounts to distribute...