Clean GitHub repo tricks AI coding agents into running malware

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious ...

Why a recent supply-chain attack singled out security firms Checkmarx and Bitwarden

It has been a bad six weeks for security firm Checkmarx. Over the past 40 days, it has been the victim of at least one supply-chain attack that delivered malware to customers on two separate occasions ...
VentureBeat

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and ...
ITWire

GitGuardian confirms Bitwarden CLI compromise tied to Dependabot attack path

GitGuardian analysis of the @bitwarden/cli compromise: GitHub used as C2, new Cloudflare exfiltration domain found, linked to April 22 Checkmarx KICS compromise via Dependabot. Around 5:00 p.m. CET, ...
Tech Times

GitHub Secret Scanning Now Watches All Public Repos for Leaked Enterprise Keys

GitHub secret scanning now extends beyond org-owned repositories: Public Monitoring scans all of GitHub.com in real time, ...
Hosted on MSN

Bitwarden confirms compromise: What 10 million users need to know

Social media is buzzing with Bitwarden breach panic, but your password vault remains untouched. The company confirmed a malicious NPM package briefly infiltrated their CLI tool-not the core password ...