{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "github",
    "label": "GitHub",
    "isStack": false,
    "url": "https://pwn.watch/t/github",
    "feed": "https://pwn.watch/t/github/feed.xml"
  },
  "counts": {
    "incidents": 15,
    "live": 2,
    "notFullyPatched": 2,
    "patched": 11
  },
  "incidents": [
    {
      "slug": "ovhcloud-cli-github-infostealer",
      "title": "OVHcloud CLI releases backdoored on GitHub",
      "url": "https://pwn.watch/i/ovhcloud-cli-github-infostealer",
      "json": "https://pwn.watch/i/ovhcloud-cli-github-infostealer.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "OVHcloud CLI (GitHub releases)",
      "tags": [
        "hosting",
        "github",
        "ovhcloud",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Five backdoored releases during the Oct 2026 window (see OVHcloud advisory)"
      ],
      "fixedVersions": [
        "Clean releases after incident; reinstall from verified source"
      ],
      "startedAt": "2026-10-19",
      "closedAt": "2026-10-20",
      "updatedAt": "2026-10-20",
      "summary": "In mid-October 2026 OVHcloud said attackers hijacked a developer GitHub account and planted an information stealer in five releases of its open-source CLI. Users who installed those releases should treat workstations as compromised and rotate credentials.",
      "xPost": null
    },
    {
      "slug": "ghostaction-github-workflows-oct-2026",
      "title": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026",
      "json": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "GitHub repositories / GitHub Actions (compromised maintainer accounts)",
      "tags": [
        "github-actions",
        "devtools",
        "github",
        "vscode"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Repos where a compromised account pushed security-audit.yml / github_actions_security.yml (Oct 8-12 2026 wave), and repos with the tasks.json + public/fonts/fa-solid-400.woff2 second stage"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-08",
      "closedAt": null,
      "updatedAt": "2026-10-22T12:04:00+02:00",
      "summary": "GhostAction, a campaign first documented by GitGuardian in Sept 2025, came back in 2026. It hit 772 repos in Aug-Sep 2026, then surged on Oct 8-12: about 1,900 compromised GitHub accounts pushed fake 'security audit' workflows to 30,000+ repositories (GitGuardian). The new payload exfiltrates the repo's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around Oct 9. The operator moved on to GitHub-themed phishing (my-github.com) and a VS Code tasks.json + fake .woff2 font stealer found in 94 repos.",
      "xPost": null
    },
    {
      "slug": "tensorlake-npm-shai-hulud-worm",
      "title": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm",
      "json": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "tensorlake (npm)",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [
        "GHSA-8g63-53c9-65j2"
      ],
      "affectedVersions": [
        "0.5.144"
      ],
      "fixedVersions": [
        "0.5.143 (safe pin); remove 0.5.144"
      ],
      "startedAt": "2026-10-07",
      "closedAt": null,
      "updatedAt": "2026-10-22T18:15:27+02:00",
      "summary": "On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.",
      "xPost": null
    },
    {
      "slug": "subql-common-npm-backdoor",
      "title": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor",
      "json": "https://pwn.watch/i/subql-common-npm-backdoor.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "@subql/common (npm) and downstream @subql/* packages",
      "tags": [
        "node",
        "npm",
        "github",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [
        "GHSA-9333-3c4x-x3h5",
        "MAL-2026-17571"
      ],
      "affectedVersions": [
        "@subql/common 5.8.3",
        "@subql/common 5.8.3-onf-rt1 (attacker canary, no payload found; 'redteam' dist-tag still points to it)",
        "Downstream ranges that resolve to 5.8.3, e.g. @subql/cli 6.6.3, @subql/node-core 19.3.1, @subql/query 2.25.0, @subql/node-ethereum 6.5.0"
      ],
      "fixedVersions": [
        "@subql/common 5.8.2 (npm 'latest')"
      ],
      "startedAt": "2026-10-05T11:56:29Z",
      "closedAt": "2026-10-10",
      "updatedAt": "2026-10-22T12:04:00+02:00",
      "summary": "On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-chaindrop-npm-keyv-august",
      "title": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august",
      "json": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages)",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Compromised patch versions published ~Aug 4 2026 (see Wiz/JFrog package lists)"
      ],
      "fixedVersions": [
        "Pin known-good versions; purge caches; npm CLI 12+ disables preinstall by default"
      ],
      "startedAt": "2026-08-04",
      "closedAt": "2026-08-15",
      "updatedAt": "2026-08-15",
      "summary": "In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-antv-npm-may",
      "title": "Mini Shai-Hulud hits AntV / timeago.js npm ecosystem",
      "url": "https://pwn.watch/i/shai-hulud-antv-npm-may",
      "json": "https://pwn.watch/i/shai-hulud-antv-npm-may.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "npm @antv/*, timeago.js, related packages under atool",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Malicious versions published during May 2026 campaign window"
      ],
      "fixedVersions": [
        "Remove malicious versions; rotate CI/cloud secrets; pin clean releases"
      ],
      "startedAt": "2026-05-19",
      "closedAt": "2026-06-01",
      "updatedAt": "2026-06-01",
      "summary": "May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.",
      "xPost": null
    },
    {
      "slug": "teampcp-trivy-checkmarx-supply-chain",
      "title": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain",
      "json": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts",
      "tags": [
        "github-actions",
        "docker",
        "devtools",
        "github",
        "trivy",
        "checkmarx",
        "vscode",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Trivy v0.69.4; trivy-action before v0.35.0; setup-trivy before v0.2.6; Checkmarx AST v2.3.28; KICS before v2.1.20 (per vendor/CSA guidance)"
      ],
      "fixedVersions": [
        "trivy-action >= v0.35.0",
        "setup-trivy >= v0.2.6",
        "Checkmarx AST/KICS patched releases per Checkmarx updates"
      ],
      "startedAt": "2026-03-01",
      "closedAt": "2026-03-31",
      "updatedAt": "2026-03-31",
      "summary": "Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-2-npm-worm-november-2025",
      "title": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025",
      "json": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)",
      "tags": [
        "npm",
        "node",
        "shai-hulud",
        "posthog",
        "postman",
        "zapier",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "e.g. posthog-node 4.18.1, 5.13.3, 5.11.3; posthog-js 1.297.3; posthog-react-native 4.11.1; @postman/tunnel-agent 0.6.5-0.6.7 (full lists in sources)"
      ],
      "fixedVersions": [
        "Malicious versions unpublished; use versions published after 2025-11-24 per each vendor"
      ],
      "startedAt": "2025-11-24",
      "closedAt": "2025-11-26",
      "updatedAt": "2025-11-26",
      "summary": "A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-npm-worm-september-2025",
      "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025",
      "json": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)",
      "tags": [
        "npm",
        "node",
        "github-actions",
        "shai-hulud",
        "crowdstrike",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Specific malicious versions of 500+ npm packages (see Socket / CISA lists)"
      ],
      "fixedVersions": [
        "Malicious versions removed from npm; upgrade to versions published after the incident"
      ],
      "startedAt": "2025-09-14",
      "closedAt": "2025-09-23",
      "updatedAt": "2025-09-23",
      "summary": "A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.",
      "xPost": null
    },
    {
      "slug": "nx-s1ngularity-npm-supply-chain-august-2025",
      "title": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025",
      "json": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "nx and @nx/* npm packages",
      "tags": [
        "npm",
        "node",
        "github-actions",
        "ai",
        "nx",
        "s1ngularity",
        "github",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [],
      "affectedVersions": [
        "nx 20.9.0-20.12.0, 21.5.0-21.8.0",
        "@nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0",
        "@nx/eslint 21.5.0",
        "@nx/key, @nx/enterprise-cloud 3.2.0"
      ],
      "fixedVersions": [
        "Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c)"
      ],
      "startedAt": "2025-08-26",
      "closedAt": "2025-08-29",
      "updatedAt": "2025-08-29",
      "summary": "Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.",
      "xPost": null
    },
    {
      "slug": "reviewdog-action-setup-github-action-cve-2025-30154",
      "title": "reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability",
      "url": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154",
      "json": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "reviewdog action-setup GitHub Action",
      "tags": [
        "github-actions",
        "devtools",
        "reviewdog",
        "github",
        "supply-chain",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-30154"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-24",
      "closedAt": "2025-03-24",
      "updatedAt": "2025-03-24",
      "summary": "reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. Added to CISA KEV on 2025-03-24.",
      "xPost": null
    },
    {
      "slug": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "title": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066",
      "json": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "tj-actions/changed-files GitHub Action",
      "tags": [
        "github-actions",
        "devtools",
        "tj-actions",
        "reviewdog",
        "github",
        "coinbase",
        "supply-chain",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-30066"
      ],
      "affectedVersions": [
        "tj-actions/changed-files through 45.0.7 (tags repointed March 14-15, 2025)"
      ],
      "fixedVersions": [
        "46.0.1 (see GitHub advisory GHSA-mw4p-6x4p-x5m5)"
      ],
      "startedAt": "2025-03-14",
      "closedAt": "2025-03-20",
      "updatedAt": "2025-03-20",
      "summary": "Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.",
      "xPost": null
    },
    {
      "slug": "ultralytics-pypi-supply-chain-attack",
      "title": "Ultralytics PyPI releases backdoored with a crypto miner",
      "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack",
      "json": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "ultralytics (PyPI)",
      "tags": [
        "python",
        "pypi",
        "github-actions",
        "ai",
        "ultralytics",
        "supply-chain",
        "cryptominer",
        "github"
      ],
      "cveIds": [],
      "affectedVersions": [
        "8.3.41",
        "8.3.42",
        "8.3.45",
        "8.3.46"
      ],
      "fixedVersions": [
        "Malicious versions removed from PyPI; see vendor advisory for the clean release"
      ],
      "startedAt": "2024-12-04",
      "closedAt": "2024-12-11",
      "updatedAt": "2024-12-11",
      "summary": "Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.",
      "xPost": null
    },
    {
      "slug": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "title": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023",
      "json": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft Azure Storage (SAS token in a GitHub repo)",
      "tags": [
        "ai",
        "microsoft",
        "azure",
        "github",
        "secrets",
        "misconfiguration",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-06-22",
      "closedAt": "2023-09-18",
      "updatedAt": "2023-09-18",
      "summary": "A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.",
      "xPost": null
    },
    {
      "slug": "github-rsa-ssh-host-key-exposed-2023",
      "title": "GitHub's RSA SSH host key briefly exposed in a public repo",
      "url": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023",
      "json": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "GitHub (github.com SSH)",
      "tags": [
        "devtools",
        "github",
        "ssh",
        "secrets"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-03-24",
      "closedAt": "2023-03-24",
      "updatedAt": "2023-03-24",
      "summary": "GitHub's private RSA SSH host key for github.com was briefly exposed in a public repository. GitHub rotated it as a precaution, which meant anyone connecting over SSH with RSA saw a host key mismatch warning until they updated known_hosts.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Bhavesh Verma",
      "handle": "xbhaveshverma",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2102764953153474560/GdTC_kqB_bigger.jpg",
      "text": "Tensorlake npm Package Poisoned by the Shai-Hulud Worm, Credential-Stealing Payload Targeted AI Agent Infrastructure and Carried a “Hostage Token” That Triggers Destruction if Revoked\n \nOn October 8, 2026, a malicious release of the tensorlake npm package, version 0.5.144, was",
      "date": "2026-10-14T07:30:00.000Z",
      "url": "https://x.com/xbhaveshverma/status/2110271890346623049",
      "media": [],
      "incident": "tensorlake-npm-shai-hulud-worm"
    },
    {
      "authorName": "Threat Intelligence",
      "handle": "threatintel",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1696530233028161536/U_hdVndn_bigger.jpg",
      "text": "#ThreatProtection GhostAction now phishes open-source maintainers with fake GitHub sign-in alerts to steal credentials, 2FA codes and OAuth tokens. Read more about Symantec’s protection: https://t.co/GN7LOBQNZj",
      "date": "2026-10-14T07:22:43.000Z",
      "url": "https://x.com/threatintel/status/2110270059365191876",
      "media": [],
      "incident": "ghostaction-github-workflows-oct-2026"
    },
    {
      "authorName": "sunil kumawat",
      "handle": "Sunil_kumawat17",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2098057965584732161/FSLSFQ4M_bigger.jpg",
      "text": "1/ npm: tensorlake@0.5.144 (Oct 8) shipped a Shai-Hulud-style worm in a preinstall hook. It hunts npm, GitHub and cloud creds plus .claude/.cursor configs.\n\nTreat the host as compromised. Socket: remove gh-token-monitor before revoking tokens, or it can wipe your home dir.",
      "date": "2026-10-12T03:42:11.000Z",
      "url": "https://x.com/Sunil_kumawat17/status/2109489785181991309",
      "media": [],
      "incident": "tensorlake-npm-shai-hulud-worm"
    },
    {
      "authorName": "Techzine",
      "handle": "techzine",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1240303566201511936/gHRGR8Fs_bigger.png",
      "text": "The Shai-Hulud worm infected the npm SDK of the AI platform Tensorlake. The malware steals credentials and can wipe home directories when tokens are revoked. dlvr.​it/TVrLFR #Security #npm #ShaiHulud #Socket #Tensorlake - Follow for more https://t.co/mLg7PlLPhr",
      "date": "2026-10-09T07:37:16.000Z",
      "url": "https://x.com/techzine/status/2108461779328332283",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HULCz6Ga8AE7wrg.jpg"
        }
      ],
      "incident": "tensorlake-npm-shai-hulud-worm"
    },
    {
      "authorName": "GMO Flatt Security Inc.",
      "handle": "flatt_sec_en",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1403333053322121218/K05KKmYR_bigger.jpg",
      "text": "We have published a new blog post covering a recent software supply chain attack on the @subql/common npm package.\n\nIt covers technical details of the compromised package, as well as guidance on response if affected, as well as recommendations for users to protect against supply",
      "date": "2026-10-06T12:09:04.000Z",
      "url": "https://x.com/flatt_sec_en/status/2107443017829519848",
      "media": [],
      "incident": "subql-common-npm-backdoor"
    }
  ],
  "changes": [
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-16",
      "title": "OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron.",
      "body": null,
      "sourceUrl": "https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-13",
      "title": "GitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted.",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-11",
      "title": "Phishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/ghostaction-attackers-plant-credential.html",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-10",
      "title": "SubQuery maintainer: compromised token deleted, security review started.",
      "body": null,
      "sourceUrl": "https://github.com/subquery/subql/issues/3047",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-09",
      "title": "Socket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered.",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ghostaction-cloud-credentials",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08",
      "title": "Accounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration.",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/ghostaction-returns",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08",
      "title": "0.5.144 published via the project’s release workflow.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08+",
      "title": "StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-07",
      "title": "Malicious commits land on tensorlakeai/tensorlake main.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-06",
      "title": "GMO Flatt Security publishes payload analysis and response guidance.",
      "body": null,
      "sourceUrl": "https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T11:56Z",
      "title": "Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier).",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/subql-ecosystem-compromised",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T12:14Z",
      "title": "StepSecurity opens security issue #3047 in subquery/subql.",
      "body": null,
      "sourceUrl": "https://github.com/subquery/subql/issues/3047",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T12:46Z",
      "title": "GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2.",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-9333-3c4x-x3h5",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-08-31",
      "title": "2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4.",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "shai-hulud-chaindrop-npm-keyv-august",
      "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "partial",
      "date": "2026-08-04",
      "title": "keyv/cacheable malicious releases observed; worm begins propagating.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august"
    },
    {
      "incident": "shai-hulud-chaindrop-npm-keyv-august",
      "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "partial",
      "date": "2026-08-04/06",
      "title": "Microsoft, Elastic, JFrog publish analyses; 400+ packages listed.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Trivy compromise disclosed; Microsoft guidance published.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "teampcp-trivy-checkmarx-supply-chain",
      "incidentTitle": "TeamPCP supply-chain campaign: Trivy → Checkmarx GitHub Actions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03",
      "title": "Campaign expands to Checkmarx GitHub Actions (Sysdig / Checkmarx updates).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/teampcp-trivy-checkmarx-supply-chain"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "GitHub privatizes malicious repos; public count drops to ~300",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "PostHog publishes its post-mortem",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "First compromised package published (03:10 UTC)",
      "body": null,
      "sourceUrl": "https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Postman unpublishes 17 infected packages (51 versions)",
      "body": null,
      "sourceUrl": "https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Last compromised package seen (~17:00-18:00 UTC)",
      "body": null,
      "sourceUrl": "https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-23",
      "title": "CISA alert: widespread supply chain compromise impacting npm (500+ packages)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-16",
      "title": "Largest burst, nearly 100 packages, including @crowdstrike scope",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-15",
      "title": "Worm discovered; @ctrl/tinycolor and ~40 packages found compromised",
      "body": null,
      "sourceUrl": "https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-14",
      "title": "First compromised versions published (17:58 UTC)",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "ghostaction-github-workflows-oct-2026",
      "incidentTitle": "GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-09",
      "title": "GitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.)",
      "body": null,
      "sourceUrl": "https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/",
      "url": "https://pwn.watch/i/ghostaction-github-workflows-oct-2026"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-28/29",
      "title": "Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-27",
      "title": "GitHub disables attacker-created s1ngularity repositories (09:00 UTC)",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-26",
      "title": "Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-24",
      "title": "Attacker exploits the workflow and exfiltrates the npm token",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-21",
      "title": "A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "reviewdog-action-setup-github-action-cve-2025-30154",
      "incidentTitle": "reviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-24",
      "title": "CISA added CVE-2025-30154 to the KEV catalog (due 2025-04-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/reviewdog-action-setup-github-action-cve-2025-30154"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-20",
      "title": "tj-actions and reviewdog maintainers finish remediation",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-18",
      "title": "CISA adds CVE-2025-30066 to KEV; reviewdog actions found compromised too",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-15",
      "title": "GitHub removes the action, then restores a cleaned repository",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-14",
      "title": "Coinbase agentkit runs the malicious action and leaks a write token (15:10 UTC)",
      "body": null,
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-14",
      "title": "All tj-actions/changed-files tags replaced with malicious commits (16:57 UTC); StepSecurity detects it",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "tj-actions-changed-files-supply-chain-cve-2025-30066",
      "incidentTitle": "tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-11",
      "title": "Malicious commit pushed to reviewdog/action-setup v1 tag",
      "body": "Reverted about two hours later.",
      "sourceUrl": "https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/",
      "url": "https://pwn.watch/i/tj-actions-changed-files-supply-chain-cve-2025-30066"
    },
    {
      "incident": "ultralytics-pypi-supply-chain-attack",
      "incidentTitle": "Ultralytics PyPI releases backdoored with a crypto miner",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-11",
      "title": "PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed",
      "body": null,
      "sourceUrl": "https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/",
      "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack"
    },
    {
      "incident": "ultralytics-pypi-supply-chain-attack",
      "incidentTitle": "Ultralytics PyPI releases backdoored with a crypto miner",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-05",
      "title": "Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner",
      "body": null,
      "sourceUrl": "https://github.com/ultralytics/ultralytics/issues/18027",
      "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack"
    },
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-18",
      "title": "Public disclosure by Wiz and Microsoft",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    },
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-24",
      "title": "Microsoft revokes the SAS token",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    },
    {
      "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023",
      "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-22",
      "title": "Wiz reports the exposure to Microsoft",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers",
      "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023"
    },
    {
      "incident": "github-rsa-ssh-host-key-exposed-2023",
      "incidentTitle": "GitHub's RSA SSH host key briefly exposed in a public repo",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-24",
      "title": "GitHub replaces its RSA SSH host key; users must update known_hosts",
      "body": null,
      "sourceUrl": "https://github.blog/news-insights/company-news/we-updated-our-rsa-ssh-host-key/",
      "url": "https://pwn.watch/i/github-rsa-ssh-host-key-exposed-2023"
    }
  ]
}