The Shai-Hulud NPM Worm Returns as "Sha1-Hulud: The Second Coming" - Devastating Supply Chain Attack Compromises Zapier and ENS Ecosystems, Creates 22,000+ Malicious Repositories and counting ...
npm compromised package and cooldown checks Two StepSecurity GitHub Checks stop this kind of attack at the pull request, before anything is installed. The Package Compromised Updates check fails a PR ...
litellm 1.107.0 shipped a credential stealer and an hourly remote code loader in all seven PyPI wheels and the official Docker images. The attacker hijacked BerriAI's release workflow with a GitHub ...
Inventory the Claude Code and Codex plugins on developer machines and in your GitHub repositories: where each came from, what it bundles, whether it is enabled, and which repositories distribute it.
Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual ...
The workflow is disguised as a security improvement and exfiltrates two categories of data to a hardcoded IP address over plain HTTP: the repository's named GitHub Actions secrets, and every cloud, AI ...
Why this matters Developers link AI provider accounts to OpenCode so the agent can call models on their behalf. If those linked credentials were exposed, an attacker could run inference against the ...
Read the blog to explore how StepSecurity stood out and earned a spot in CRN’s 10 Hottest DevOps Startups of 2024. GitHub’s native egress firewall covers GitHub-hosted Linux runners. See five ways ...
On October 5, 2026, StepSecurity analyzed @subql/common@5.8.3 on npm and identified a hidden payload that collects credentials and supports remote shell access. It starts during installation and when ...
StepSecurity's AI Package Analyst and Harden-Runner detected the compromise of axios, the largest npm supply chain attack on a single package by download count, before any public disclosure existed.
Compromised versions run a malicious payload at npm install time through a binding.gyp node-gyp hook, harvesting credentials from sources like GitHub Actions secrets, cloud provider keys, and package ...
Introducing Secure Registry by StepSecurity: install-time defense for the npm supply chain. Block malicious packages, enforce package cooldowns, and protect CI/CD pipelines, developer machines, and ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results