GitHub hit with another major attack — Megalodon hits over 5,000 repos with malware-laden commits

Among other things, Megalodon was observed grabbing AWS secret keys and Google Cloud access tokens, instance role credentials ...
SecurityWeek

Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack

The Megalodon supply chain attack poisoned over 5,500 GitHub repositories via automated commits injecting GitHub Actions workflows.
Tech Times

GitHub CISO Names Nx Console as Root of 3,800-Repo Breach: OpenAI, Grafana Also Hit

GitHub CISO Alexis Wales confirmed Thursday that a poisoned build of the Nx Console Visual Studio Code extension — live on ...
cybernews

Megalodon stalks over 5,000 GitHub repos in new assault on open source

Massive scale attack The "Megalodon" campaign compromised over 5,000 GitHub repositories in 6 hours by weaponizing automated GitHub Actions workflows that execute when developers push code or merge ...
GovInfoSecurity

Breach Roundup: Shai-Hulud Copycat Hits npm

This week, more incidents that we can here list. Among them: cloned Shai-Hulud malware, a new maximum CVSS Cisco flaw. Edge ...
Tech Times

Claude Code Study: Four Competing Teams Built Same Agent Harness, Pointing to Real AI Moat

A research team at Mohamed bin Zayed University of Artificial Intelligence published a finding in April 2026 that has gained traction in engineering circles for reasons that go beyond its headline ...

Gemini accused of 30,000-line code purge and fake recovery report

A developer claims Google’s Gemini coding assistant deleted nearly 30,000 lines of working production code while making ...
Windows Report

GitHub Links Internal Repository Breach To TanStack Supply-Chain Attack

GitHub says the breach of roughly 3,800 internal repositories was tied to the wider TanStack npm supply-chain attack.

GitHub links repo breach to TanStack npm supply-chain attack

GitHub says the hackers who breached 3,800 internal repositories gained access via a malicious version of the Nx Console VS ...

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed attackers stole 3,800 internal repositories via a poisoned VS Code extension. The same threat group, TeamPCP ...
Windows Report

GitHub Confirms Breach After Malicious VS Code Extension Exposed 3,800 Repositories

GitHub confirmed a breach affecting about 3,800 internal repositories after an employee installed a malicious VS Code ...

Hundreds of malicious npm packages discovered in AntV ecosystem

The data visualization ecosystem AntV was targeted by a Mini Shai Hulud supply chain attack involving hundreds of malicious npm packages.