Topic
Staging, archiving and chunked upload of harvested credentials and secrets to attacker-controlled web infrastructure.
Two compromised maintainer accounts pushed a GhostAction workflow into 346 GitHub repositories on Oct. 8, according to Socket's research team. GitGuardian, which named the campaign, is still reviewing the wave against its own data.
Reality
Two CVEs describe a startup window where a repository's own config file set the CLI's base URL and hooks while the trust prompt was still pending. On Linux, the key that leaks shares a plaintext file with GitHub and AWS tokens.
Reality
Install hooks and .pth files execute before your first import, which puts the useful controls in resolver precedence and environment scope rather than in a test suite that passes either way.
Reality
KnowBe4 says a new build of the commodity infostealer uses Unicode emoji to break string signatures and keeps its final payload off disk. The lure is a spoofed bank thread aimed at finance teams.
Reality
Check Point found Claude Code project configs could execute commands and steal Anthropic API keys on clone. Anthropic has patched it. The trust model it exposed is still yours to manage.
Reality