api.github.com

Related reports (5)

Title/body text match only.

• GitHub internal repositories breached

  GitHub internal repositories breached <p>A malicious VS Code extension led to cloned private repositories, reportedly offered for sale on a criminal forum</p> Categories: Threat Research Tags: GitHub, Supply chain GitHub internal repositories breached | SOPHOS Skip to Content O

• TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack

  TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "

• Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp

  Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-pr

• lightning PyPI Compromise: A Bun-Based Credential Stealer in Python

  lightning PyPI Compromise: A Bun-Based Credential Stealer in Python A malicious release of the lightning PyPI package ships a credential-stealing Bun payload that runs on import. Snyk has a live advisory. Here's what's in the package, what to rotate, and how the payload pattern

• "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages

  "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages A new npm supply chain attack self-branded "Mini Shai-Hulud" compromised four SAP-ecosystem packages on April 29, 2026. Snyk has live advisories. Here's the technical breakdown, IOCs, and w

All reports →