A new supply chain attack on GitHub, dubbed 'GhostAction,' has compromised 3,325 secrets, including PyPI, npm, DockerHub, ...

A supply chain attack involving malicious GitHub Action workflows has impacted hundreds of repositories and thousands of ...

GitHub projects have been targeted with malicious commits and pull requests, in an attempt to inject backdoors into these projects. Most recently, the GitHub repository of Exo Labs, an AI and ...

Attackers abused GitHub Actions workflows to siphon off thousands of credentials from hundreds of npm and PyPI repositories.

GitHub is great for pushing a big project forward, but not always great to get everyone on the same track. That’s why the company is introducing templates. The goal is to help everyone move in ...

GitHub will roll out dependency review, a security assessment for pull requests, in the coming weeks to developers. SEE: Meet the hackers who earn millions for saving the web, one bug at a time ...

On September 5, 2025, GitGuardian discovered GhostAction, a massive supply chain attack affecting 327 GitHub users across 817 ...