// tag
Security incidents tagged GitHub. Newest first.
› OVHcloud CLI (GitHub releases)
In mid-October 2026 OVHcloud said attackers hijacked a developer GitHub account and planted an information stealer in five releases of its open-source CLI. Users who installed those releases should treat workstations as compromised and rotate credentials.
› GitHub repositories / GitHub Actions (compromised maintainer accounts)
GhostAction, a campaign first documented by GitGuardian in Sept 2025, came back in 2026. It hit 772 repos in Aug-Sep 2026, then surged on Oct 8-12: about 1,900 compromised GitHub accounts pushed fake 'security audit' workflows to 30,000+ repositories (GitGuardian). The new payload exfiltrates the repo's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around Oct 9. The operator moved on to GitHub-themed phishing (my-github.com) and a VS Code tasks.json + fake .woff2 font stealer found in 94 repos.
› tensorlake (npm)
On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.
› @subql/common (npm) and downstream @subql/* packages
On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.
› npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages) partial fix
In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.
› npm @antv/*, timeago.js, related packages under atool partial fix
May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.
› Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts patched
Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.
Tensorlake npm Package Poisoned by the Shai-Hulud Worm, Credential-Stealing Payload Targeted AI Agent Infrastructure and Carried a “Hostage Token” That Triggers Destruction if Revoked On October 8, 2026, a malicious release of the tensorlake npm package, version 0.5.144, was
#ThreatProtection GhostAction now phishes open-source maintainers with fake GitHub sign-in alerts to steal credentials, 2FA codes and OAuth tokens. Read more about Symantec’s protection: t.co/GN7LOBQNZj
1/ npm: tensorlake@0.5.144 (Oct 8) shipped a Shai-Hulud-style worm in a preinstall hook. It hunts npm, GitHub and cloud creds plus .claude/.cursor configs. Treat the host as compromised. Socket: remove gh-token-monitor before revoking tokens, or it can wipe your home dir.
The Shai-Hulud worm infected the npm SDK of the AI platform Tensorlake. The malware steals credentials and can wipe home directories when tokens are revoked. dlvr.it/TVrLFR #Security #npm #ShaiHulud #Socket #Tensorlake - Follow for more t.co/mLg7PlLPhr
We have published a new blog post covering a recent software supply chain attack on the @subql/common npm package. It covers technical details of the compromised package, as well as guidance on response if affected, as well as recommendations for users to protect against supply
