npm-stat data it has been downloaded a total read more about Researchers Detect Malicious npm Package Targeting GitHub-Owned Repositories

At a Glance Attribute Details Organization Multiple entities (including the US CDC, BuildBuddy, and Civica) Data Exposed GitHub App RSA private keys, repository access, administrative permissions Number Affected 474 valid keys across 440 distinct Apps; hundreds of organizations exposed Cause Cryptographic private keys committed into public and third-party repositories Disclosure Status

Instead of echoing your secrets in your actions use the official Github Google Cloud Action

VulnCheck scans the Go module ecosystem for module repositories affected by repojacking, and discover hundreds of thousands of affected module-versions.

OAuth Attacks on Microsoft 365 and GitHub are escalating fast. Discover how fake Adobe, DocuSign, and GitHub apps are compromising user...

Emergence of AgentBaiting Threat Vector The surging popularity of artificial intelligence tools has transformed skill directories into lucrative initial access points. Attackers target Model Context Protocol (MCP) server repositories to distribute malicious loads. Notably, the FakeGit operation weaponized roughly 7,600 GitHub repositories. This widespread campaign actively disseminated SmartLoader and the StealC infostealer. According to research from Island, over 800 repositories masqueraded as specialized AI skills and MCP servers.

GitHub expands security tools after 39M secret leaks in 2024. #GitHubSecurity #DevSecOps #Cybersecurity

GitVenom campaign uses fake GitHub repos to spread malware; exercise caution. #GitVenom #GitHubSecurity #Cybersecurity

A single line of code could allow hackers to breach MITRE and Splunk

A global malware campaign has misused GitHub repositories to infect nearly one million devices, exploiting trust signals and redirecting users from illegal streaming sites.