GitHub’s Confidential Advisory Comments Follow Repository Write Access
Confidential comments follow repository permissions.
GitHub
The Malicious npm Release Had Valid Provenance Because the Build System Worked
Provenance answered where the package was built. It could not answer whether the source reaching the trusted workflow was honest.
One Malformed Photo Put OpenAI’s Private Repository Within Reach
The upload bug lived in a third-party forum. The blast radius grew because a community sign-in token carried access into employee AI accounts and GitHub.
A Departed Employee’s Token Quietly Opened 170 Private Security Repositories
The employee had left. The token had not. GitHub traced the access path back to the wider TanStack supply-chain incident.
The Fake GitHub Download Arrived With a Microsoft-Signed EDR Killer
The repositories copied more than 40 brands. The payload then used a trusted driver to remove the tools most likely to stop it.
ChainDrop Turned Trusted npm Publishing into a Self-Propagating Attack
A new Shai-Hulud descendant spread through npm packages with legitimate-looking provenance. The incident shows why a trusted build path is not necessarily a trustworthy one. Security researchers identified a fast-moving npm supply-chain campaign on 4 August and named it ChainDrop.…
One Click in github.dev Could Reach Every Repository the Developer Could.
A malicious notebook could turn github.dev into a GitHub OAuth-token theft path with read and write access across the developer's repositories.
One Poisoned Extension Reached 3,800 of GitHub’s Internal Repositories
A compromised Nx Console update reached a GitHub employee device, stole credentials, and exposed roughly 3,800 internal repositories.