company
Secrets-detection vendor and sole publisher in this cluster; summarized the victim research and prescribed inventory, endpoint detection, validity checking and honeytokens.
No evidence-backed relationships are recorded.
Attackers moved upstream into the project's own repositories and release workflows, so the attestations checked out. Publisher reputation no longer tells you a build is clean.
Reality
GitHub now sells Advanced Security as two SKUs, at $19 and $30 per active committer per month. Neither one routes a finding to an owner or enforces a deadline.
Reality
GitGuardian says the TeamPCP campaign poisoned two LiteLLM releases on PyPI to harvest SSH keys, cloud credentials and API tokens. Detection is the cheap part of this job.
Reality
Hudson Rock's analysis of the exfiltration archive ties 118,829 CI runner dumps to 2,488 organizations. The dumps carrying no identifying metadata are the harder half.
Reality