Checkmarx confirmed its KICS open source project was compromised after a March 23 Trivy supply chain attack that let attackers hijack GitHub Action tags and poison packages to reference malware. The intrusion, attributed to TeamPCP and apparently leveraged with Lapsus for monetization, led to the exfiltration of source code, employee databases,...

Trivy, the Aqua Security vulnerability scanner, was compromised again to deliver a Python-based infostealer via malicious releases and force-pushed tags in the aquasecurity/trivy-action and aquasecurity/setup-trivy GitHub Actions, exposing CI/CD secrets and developer credentials. The payload harvests environment variables and tokens, tries to exfiltrate data to scan.aquasecurtiy[.]org or stage it in a...

Cybersecurity researchers have disclosed details of a new automated campaign called Megalodon that has pushed 5,718 malicious commits to 5,561 GitHub repositories within a six-hour window. "Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected GitHub Actions workflows containing base64-encoded bash payloads that exfiltrate CI

StepSecurity uncovered the ForceMemo campaign that injected the same malware into hundreds of Python repositories on developers' GitHub accounts beginning 8 March 2026, and traced 20 initial IoCs (nine subdomains, five domains, six IPs) plus dozens to hundreds of related artifacts. The investigation found bulk-registered look-alike domains, domains likely registered with malicious intent, numerous email-connected and string-connected domains, and IPs geolocated to a single French ISP. #ForceMemo #GitHub

The attacker employed various techniques, including distributing malicious dependencies via a fake Python infrastructure linked to GitHub projects.