Tag: config-files

Malware Security AI Announcements Engineering Technology Open Source SCA Compliance & SBOM CI/CD

Malware

tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud

[email protected] on npm ran a Mini Shai-Hulud worm at install. A maintainer account committed the payload through the GitHub web interface, and the official release workflow published it.

Malware

keyv and cacheable npm compromise: 400+ packages

An npm worm published 2,234 poisoned versions across 444 package names. Its install script stole credentials and ran a command when GitHub revoked a token.

Malware

Mini Shai-Hulud Is Still Infecting GitHub Repositories

The May 2026 Mini Shai-Hulud worm is still infecting new GitHub repositories. Hijacked actions-cool/issues-helper tags planted Claude Code and VS Code hooks in six popular repositories between 20 and...