#github-compromise
#github-compromise
[ follow ]
#credential-theft #oauth-token-theft #supply-chain-attacks #vs-code-extensions #open-source-security
Information security
fromSecurityWeek
2 months agoForceMemo: Python Repositories Compromised in GlassWorm Aftermath
Threat actors exploited stolen VS Code credentials to compromise GitHub accounts and inject malware into Python repositories through a technique called ForceMemo that leaves minimal forensic traces.
Information security
fromIT Pro
6 months agoShai-Hulud malware is back with a vengeance and hit more than 19,000 GitHub repositories so far - here's what developers need to know
Shai-Hulud worm infects npm packages, compromising ~700 packages and over 19,000 GitHub repositories to exfiltrate credentials, spread malicious payloads, and delete user files.
fromInfoWorld
6 months agoHow GlassWorm wormed its way back into developers' code - and what it says about open source security
Just a little over two weeks after GlassWorm was declared "fully contained and closed" by the open source OpenVSX project, the self-propagating worm is once again targeting Visual Studio Code extensions, add-ons that enhance open source VS Code, providing new features, debuggers, and other tools to improve developer workflows. Researchers from Koi have discovered a new wave of infections and three more compromised extensions.
Information security
fromTheregister
8 months agoDrift attackers gained entry via a Salesloft GitHub account
The Salesloft Drift breach that compromised "hundreds" of companies including Google, Palo Alto Networks, and Cloudflare, all started with miscreants gaining access to the Salesloft GitHub account in March. This new information comes from a Saturday update into the Mandiant-led investigation - Salesloft hired the incident response firm to determine the root cause and scope of the incident - and a Sunday alert that the integration between Salesloft and Salesforce has now been restored.
Information security
[ Load more ]