Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Attackers Target GitHub Developer Workflows
Coverage from BleepingComputer, The Record, and others
Articles
12
Active Days
148
The Topic
Attackers are abusing GitHub repositories, Discussions, VS Code workflows, JavaScript bundles, and vulnerable web applications to steal credentials or deliver malware. The activity combines social engineering, repository impersonation, supply-chain compromise, exploitation of exposed secrets, and automated attacks against internet-facing software. The common risk is that trusted developer infrastructure and application artifacts can provide access to source code, cloud environments, accounts, and downstream users.
First Article: 02/17/26
Latest Article: 07/14/26
Summary
- A VS Code web zero-day can be used to install a malicious extension and extract broadly scoped GitHub OAuth tokens from github.dev users.
- Hundreds of fake GitHub repositories and redirectors impersonated legitimate software projects to distribute infostealer malware.
- Fake VS Code security alerts in GitHub Discussions used fabricated CVEs, maintainer impersonation, and external downloads to target developers.
- Researchers linked Shai-Hulud worm activity to malicious packages, compromised developer accounts, and repositories storing stolen credentials.
- A scan of five million JavaScript applications found more than 42,000 exposed tokens, including repository, email, webhook, and cloud-related credentials.
- Automated exploitation of vulnerable Next.js applications harvested AWS credentials, database secrets, SSH keys, and API tokens from at least 766 hosts.
History
The story now places greater emphasis on active credential theft and supply-chain compromise across more delivery vectors, while tightening some details around the campaigns and affected artifacts. The Next.js exploitation remains central, but the reporting now more clearly frames developer infrastructure, malicious packages, and application bundles as interconnected attack paths.
The story has broadened from general GitHub-related secret theft and malware activity into a more specific set of attack paths against developer tooling, web applications, and build artifacts. The new version adds concrete campaign details, including a VS Code zero-day, fake GitHub repository impersonation, and large-scale token and secret harvesting.
Featured
Timeline: 148 Days
Hover over any logo to see coverage summary, click for full article.