Dark Reading

Malicious Python Repository Package Drops Cobalt Strike on Windows, macOS & Linux Systems

Public repositories of open source code are a critical part of the software supply chain that many organizations use to build applications. They are therefore an attractive target for adversaries ...
Infosecurity Magazine

New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositories

Security researchers have detected a malicious workflow affecting tens of thousands of GitHub repositories, including ...
Dark Reading

One-Third of Popular PyPI Packages Mistakenly Flagged as Malicious

The scanners tasked with weeding out malicious contributions to packages distributed via the popular open source code repository Python Package Index (PyPI) create a significant number of false alerts ...
VentureBeat

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and ...

Inspection Kit for Preparing for Public Repository Clone Failures: Detection Script for Unauthenticated Access Points and Configuration to Provide Tokens Only When Re…

GitHub announced that starting October 19, 2026, it may temporarily require authentication for some HTTPS clone and fetch ...
The Hacker News

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

Attackers compromised LiteLLM's release pipeline to ship a credential stealer and backdoor, then tested stolen AWS credentials.
ChannelE2E

Python Repositories Threatened by Inadvertently Exposed GitHub Token

Significant software supply chain attacks could have been deployed with the potential infiltration of the GitHub repositories for the Python programming language, Python Package Index, and Python ...