The workflow is disguised as a security improvement and exfiltrates two categories of data to a hardcoded IP address over plain HTTP: the repository's named GitHub Actions secrets, and every cloud, AI ...

Several packages in the @redhat-cloud-services npm scope were found to carry malicious payloads that fire via a preinstall hook on every npm install. The affected versions span multiple packages ...

All release tags in the Checkmarx/kics-github-action repository have been compromised with an infostealer payload. If you are using this Action pinned to any version tag, treat your CI/CD secrets as ...

AI agent skills live in two places. Developers install them on their own machines, and teams commit them to repositories so everyone who works in the codebase gets them. A skill often travels between ...

The malicious release was built from the project's own main branch and published with an npm provenance attestation. On October 5, 2026, StepSecurity analyzed @subql/common@5.8.3 on npm and identified ...

After growing ARR more than 5x in 2024 and again in 2025, StepSecurity is on pace for its biggest year yet in 2026. Here is what is driving it, and why the software supply chain security market is ...

A supply chain attack targeting Solidity and Web3 developers has been discovered across three IoliteLabs VSCode extensions (solidity-macos, solidity-windows, and solidity-linux) embedding obfuscated ...

Device Policy lets security teams allow-list VS Code extensions and enforce it fleet-wide through Intune, Jamf, Kandji, or the DMG agent. No MDM required.

For MemoryOS 2.0.34, include hosts where a normal import could reach logging initialization. Remove or quarantine the affected release and use an independently vetted replacement; this inspection did ...

Getting a talk accepted at Black Hat is a defining moment for any security company, and we're thrilled to share the key insights from our presentation at Black Hat USA 2025 in Las Vegas. Our 40-minute ...

self-replicating worm is spreading across the npm registry using binding.gyp, a file that triggers code execution during npm install without touching package.json scripts. The attack bypasses ...

Malicious 2773 beta versions of @joyfill/components and @joyfill/layouts carry an obfuscated remote access trojan and credential stealer that run on import. Here is how it works and how to check if ...