A technical audit of the Shai-Hulud worm explains how it spreads through npm workflows and exfiltrates developer secrets from GitHub, AWS, and Kubernetes environments.
A large-scale npm supply chain attack weaponized 170 packages to exfiltrate GitHub, AWS, and Kubernetes credentials from developers and organizations.
A security-focused analysis of fake DeepSeek TUI GitHub repositories used to distribute malware, with practical guidance for spotting typosquatting and verifying open-source dependency trust.
GitHub patched a critical remote code execution flaw in its internal git infrastructure within hours after Wiz Research used AI models to uncover a vulnerability that could expose millions of public and private repositories.
AI-assisted security research uncovered a critical remote code execution flaw in GitHub's internal git infrastructure, and GitHub patched it within hours after confirming no exploitation.