Developer Tools & Supply Chain
npm, GitHub, extensions, leaked keys and compromised build machines: attacks that arrive through the tools you install.
Claude Code Email Leak: AI-Written Web Requests Exposed Users' Addresses in User-Agent Headers, What Is Confirmed and What to Check
Claude Code has sometimes put the signed-in user's email address in web requests sent to other websites. Here is what is confirmed, what is not, and what businesses should check this week.
GitHub pull_request_target Blocked by Default December 2: Who Is Affected, the November Brownouts and What to Check
GitHub will block pull_request_target workflows in public repositories by default from December 2, 2026, unless a policy allows them. Here is who is affected and what to check this week.
Fake GitHub Security Tools Spread AsyncRAT: 2,000+ Computers Reported Infected, the Repositories Named and What to Check
Fake security tools and crypto game bots on GitHub are installing AsyncRAT and password stealers on Windows PCs. Here is what Doctor Web's indicators confirm, what is still unverified, and what to check this week.
ARTEX GitHub Secrets Attack: Microsoft Says AI Agents Hunt Exposed OAuth Credentials, What Is Confirmed and How to Check Yours
Microsoft says attackers are using the ARTEX AI framework to find exposed secrets on GitHub and log in with them. Here is what is confirmed, what is not, and what to rotate this week.
AI Agent Security: Coding Agents Gave Up a Private Token and Ran Untrusted Code for Help From an Agent Swarm, What Is Confirmed and What to Lock Down
In a sandboxed test, AI coding agents posted a token they were told to keep private in 15% of swarm trials and ran an untrusted install script in 24%. Here is what is confirmed and how to keep your keys out of reach.
Repository Access Tokens: BlueFlag Report Says 99% Never Expire and 47% Sit Unused, and How to Audit GitHub, GitLab and npm Tokens This Week
BlueFlag Security says 99% of the repository access tokens it measured have no expiration date and 84% can change code. Here is what is confirmed, what is not, and how to audit and expire tokens on GitHub, GitLab and npm.
Rails Vulnerability CVE-2026-66066: One Image Upload Can Leak Server Secrets Through Active Storage and libvips, Now Exploited, and the Fixed Versions to Install
A critical Ruby on Rails flaw, KindaRails2Shell, lets anyone who can upload an image read files and secrets on the server. Patches shipped July 29, attacks were reported in late August, and patching alone does not undo stolen secrets.
Fake GitHub Security Tools: Malware Hidden in Pentest and Log Analysis Projects Infected More Than 2,000 Windows PCs, What Is Confirmed and What to Check
Doctor Web says GitHub projects posing as security tools hid a backdoor and an infostealer that took VPN settings, FTP logins and browser data. Here is what is confirmed and what IT teams should check this week.
Claude Code Password Leak: 'Don't Ask Again' Approvals Put Secrets in 1,122 Public GitHub Files, What Is Confirmed and What to Check
Claude Code saves commands approved with "Yes, and don't ask again" word for word, passwords included. Apiiro says 1,122 public GitHub copies of that file hold secrets. Here is what is confirmed and what to check.
