Security firm Novee has revealed Cordyceps as a class of exploitable CI/CD vulnerabilities across open-source repositories ...

Attackers can inject indirect prompts in normal-looking repositories to trick Claude Code into spawning a reverse shell.

Threat actors impersonate GitHub's security and recruitment teams in phishing attacks to hijack repositories using malicious OAuth apps in an ongoing extortion campaign wiping compromised repos. The ...

Fake reviews, news articles, and GitHub accounts are a potent mix for promoting malware.

New analysis from Check Point Research traced the operation to a Rust-based clipboard hijacker, a "clipper" that swaps copied ...