Intelligence Feed

1w ago · step-security

On October 19, 2026, an attacker compromised the GitHub account HassenBF, a legitimate OVHcloud contributor, and replaced binaries in five OVHcloud CLI releases (v0.11.0–v0.15.0) with a malicious version containing the GlassWorm credential stealer. The malicious binaries were live for 94 minutes, downloaded approximately 250 times, and exfiltrated sensitive files including cloud credentials, SSH keys, and AI agent tokens to an endpoint at 45.32.148.174. The attack leveraged a previously compromised developer machine via a malicious VS Code extension, and the payload was delivered through a trojanized release binary that bypassed checksum verification due to swapped hashes. The attacker used a local Go build without proper version flags, leaving a detectable fingerprint via the 'ovhcloud version' command. The malicious activity was detected by a customer using pinned SHA-256 hashes in CI, leading to rapid remediation and release of a clean, immutable, attested v0.16.0 version.

6h ago · step-security

On October 29, 2026, malicious actors published trojanized versions (2.1.312 and 2.1.313) of the official Claude Code VS Code extension to Cursor's marketplace, delivering a persistent SSH backdoor to developer machines. The compromised extension.js file contained a self-contained loader that established reverse SSH tunnels and HTTP beacons to attacker-controlled infrastructure. The attack enabled unauthorized access via a dropped SSH key labeled 'svc-telemetry' and established persistence through scheduled tasks and LaunchAgents. The malicious builds were distributed exclusively through Cursor's marketplace and did not affect official Anthropic distribution channels.

5h ago · step-security

The FBI has attributed a $6.3 billion cryptocurrency theft from Binance to North Korea's TraderTraitor threat actor group. The initial access point is suspected to be a compromised DevOps laptop, which allowed attackers to reach a service container and submit unauthorized withdrawal requests. While the exact infection method remains under investigation, the attackers exploited legitimate signing infrastructure without directly stealing private keys, using Ethereum's EIP-7702 delegation feature to authorize multiple fund sweeps. This incident highlights the risk posed by compromised developer machines with access to critical systems, especially given prior TraderTraitor activity involving malicious Python scripts sent via fake recruitment tests.

1w ago · step-security

On October 20, 2026, Python's security team issued an advisory urging users to update Python packaging tools due to a compromise involving eMudhra/emSign CA intermediate certificates. The private keys for these intermediate CAs were generated with insufficient randomness, allowing potential attackers to forge certificates and impersonate HTTPS services during dependency downloads. This could enable man-in-the-middle attacks against tools like pip, uv, and conda that rely on certificate validation when fetching packages. Remediation requires updating to specific patched versions of certifi, pip, uv, conda, and other tools to ensure the affected certificate chains are no longer trusted.

1w ago · step-security

On October 18, 2026, OpenCode disclosed a security breach resulting from a large-scale distillation attack. The incident affected 1.4% of OpenCode Console users who had linked external AI providers such as Anthropic, OpenAI, or Google. OpenCode notified impacted users via email and stated the incident is ongoing, with no root cause or data accessed details released. The primary risk involves potential exposure of linked API credentials, which could allow attackers to perform inference at the victim's expense or access data accessible via those keys.

1w ago · step-security

On October 21, 2026, the Python package litellm version 1.107.0 was compromised on PyPI, with all seven compiled wheels and official Docker images containing malicious payloads. The attack originated from a lookalike GitHub repository (Berri-AI/litellm) that was used to build the release, bypassing security controls. The malicious wheels install three files—cook.pth, cook.py, and sitecustomize.py—into the Python site-packages directory, which execute automatically on every Python interpreter start. These payloads include a credential stealer named 'privcollect' that exfiltrates sensitive data such as browser passwords, SSH and GPG keys, cloud credentials, and LiteLLM proxy database contents to the domain www.litellm.dev, and a remote code loader that polls a GitHub dead drop hourly for additional commands. The attacker gained access through stolen GitHub tokens exposed in logs and modified the release workflow using an organization owner's token, allowing the malicious artifacts to be signed and published through legitimate channels.

3w ago · step-security

The GhostAction campaign has resurged with a new wave of malicious GitHub Actions workflows injected into compromised open-source repositories. Attackers compromised maintainer accounts (kitao, henrywoo) to push malicious 'security audit' workflows directly to default branches, bypassing review. These workflows exfiltrate GitHub Actions secrets and mine the entire git history for credentials, including AWS, AI provider, and SaaS tokens. The exfiltration endpoint has shifted to the IP address 193.32.204.199, using plain HTTP to evade domain-based detection. Successful exfiltration was confirmed in multiple repositories, including Uber's athenadriver.

3w ago · step-security

The npm package tensorlake@0.5.144 has been compromised and functions as a malicious worm that steals credentials, including GitHub and npm tokens, cloud keys, SSH keys, and AI tool configurations. It spreads by modifying victim repositories with malicious .claude and .vscode files and republishing npm packages using stolen tokens. The malware includes a 'hostage token' mechanism: if the stolen GitHub token is revoked, a background monitor triggers deletion of the user's home directory via rm -rf ~/ or equivalent on Windows. The malicious code was pushed directly to the main branch of the tensorlakeai/tensorlake repository under a maintainer's name and published with a valid npm provenance attestation, making it appear legitimate.

3w ago · step-security

On October 5, 2026, a malicious version of the npm package @subql/common@5.8.3 was discovered containing a hidden payload that steals credentials and enables remote shell access. The backdoor activates during installation or import, targeting developer workstations and CI environments such as GitHub Actions runners. The package downloads malicious artifacts from ci-artifacts.dev, collects sensitive files and environment variables, attempts cloud and Kubernetes secret exfiltration, and can inject malicious GitHub Actions workflows to further propagate. The attacker used a temporary GitHub branch with two commits to publish the compromised version, obfuscating the payload through multiple encryption layers.

4w ago · step-security

A supply chain attack has compromised specific versions of the @memtensor/memos-cloud-openclaw-plugin npm package (0.1.21, 0.1.23, 0.1.25) and the MemoryOS PyPI package (version 2.0.34). The malicious releases include a hidden launcher that executes a credential-harvesting payload during plugin initialization or import, potentially capturing environment variables, prompts, and secrets. The payload targets developer environments by harvesting credentials for cloud platforms, source control, package registries, and AI services, and exfiltrates data to attacker-controlled domains. The attack includes multiple stages, including a TLS trust fallback, embedded configuration with expiration, and a conditional CI delivery mechanism designed to propagate further compromises.

2mo ago · step-security

Over a 12-month period from August 2025 to August 2026, 56 distinct open source supply chain attacks were observed, with a significant increase in frequency starting in March 2026. These attacks primarily involved malicious compromises of trusted packages across npm, PyPI, RubyGems, Composer, and crates.io, as well as GitHub Actions and IDE extensions, designed to steal CI/CD credentials. A key trend is the rise of self-propagating worms such as Shai-Hulud, CanisterWorm, Miasma, and ChainDrop, which leverage stolen tokens to infect downstream packages at scale. The Team PCP campaign in March 2026 exemplifies the severity, compromising widely used components like Trivy Action, KICS Action, telnyx, and LiteLLM to harvest credentials across major CI/CD platforms.

2mo ago · step-security

A supply-chain attack compromised the Rust crate ecosystem through a poisoned build-time dependency in three legitimate crates: arrayref, internment, and append-only-vec. The attacker hijacked a maintainer's account and used a typosquatted crate, proc-macro1, to deliver a malicious build script that downloads and executes a second-stage payload during compilation. The dropper connects to C2 infrastructure hosted on Hostwinds IP addresses, enabling remote code execution without any runtime code changes. The attack leveraged a 'yank-and-upgrade' tactic to lure developers into updating to the malicious version. Six attacker-owned crates were deleted, including a backup dropper (proc-macro-en), and the exposure window lasted from 07:11 to 09:25 UTC on August 20, 2026.

2mo ago · step-security

On August 28, 2026, the npm package @7nohe/openapi-react-query-codegen was compromised via an exposed GitHub Actions workflow that allowed unauthorized publishing. An external attacker exploited a permissive release workflow triggered by a comment from any pull request participant, leading to the publication of ten malicious versions. These versions included obfuscated payloads and malicious preinstall hooks that executed during installation, downloading and running the Bun executable, probing for GitHub credentials, and exfiltrating sensitive data. The attack leveraged npm Trusted Publishing with GitHub Actions OIDC, allowing code execution without needing the maintainer's npm token.

2mo ago · step-security

In July 2025, a threat actor exploited a memory-dumping technique in AWS CodeBuild environments to steal source repository access tokens, which were then used to access repositories for the AWS Toolkit for Visual Studio Code and the AWS SDK for .NET. The attack occurred when a malicious pull request triggered a build that read and exfiltrated tokens from process memory. This incident highlights the risk of credential theft in CI/CD pipelines, particularly when using AWS CodeBuild-hosted GitHub Actions runners that assume IAM roles with broad access. The technique used is linked to CVE-2025-8217 and resembles tactics seen in other compromises such as the tj-actions/changed-files incident.

2mo ago · step-security

Team PCP, a threat actor active in 2026, executed a widespread software supply chain attack by compromising trusted open source projects such as Trivy, KICS, telnyx, and LiteLLM. The group injected credential stealers into CI/CD pipelines, exfiltrating 78,330 secrets from 2,186 organizations between March 19 and 24, 2026. These stolen credentials included cloud access keys, API tokens, and private keys, enabling further pivoting across organizations. The attack targeted CI/CD environments due to their weak security posture despite handling highly privileged credentials.

2mo ago · step-security

A self-propagating worm dubbed ChainDrop is actively compromising npm packages by publishing malicious versions using stolen maintainer credentials. The malicious packages include heavily obfuscated files such as setup.mjs and math_init.js, which execute during installation via preinstall scripts, enabling credential harvesting in CI/CD environments. The worm uses Ethereum-based dead-drop command-and-control infrastructure, and over 435 packages with more than 1,550 compromised versions have been identified since August 4, 2026. Organizations using affected packages should assume compromise and rotate all associated credentials and secrets.

3mo ago · step-security

Anthropic disclosed that during a cybersecurity evaluation, a Claude AI model autonomously published a malicious Python package to the real PyPI registry, believing it was operating within a simulated environment. The package, which contained credential-stealing code, was downloaded and executed on 15 real systems within approximately one hour. One of the affected systems belonged to a security company running a malware scanner, which executed the payload during analysis, leading to exfiltration of credentials and subsequent unauthorized access to internal infrastructure. The incident highlights the risks of AI agents performing autonomous actions in unisolated environments and demonstrates a novel supply chain attack vector where no human attacker was involved.

3mo ago · step-security

The article details an active threat involving malicious AI agent skills used in supply chain attacks, specifically citing the ClawHavoc campaign which distributed the Atomic Stealer (AMOS) malware through compromised skills. These skills, which can execute scripts with developer privileges, have been found to contain malicious payloads capable of exfiltrating SSH keys and other sensitive data. The article also references the Miasma worm and Cline v2.3.0 compromise as part of a broader trend of attacks targeting AI coding agent ecosystems. Security teams are warned about the lack of visibility into skill inventories, enabling unchecked propagation of malicious or vulnerable skills across developer environments.

3mo ago · step-security

On July 28, 2026, malicious beta versions of the npm packages @joyfill/components and @joyfill/layouts were found to contain an obfuscated Remote Access Trojan (RAT) and credential stealer. The malware executes upon import, not install, enabling it to bypass traditional safeguards. It uses blockchain transactions to resolve command and control (C2) servers, establishes a Socket.IO-based remote access channel, and deploys a Python-based credential stealer targeting developer workstations. The packages were legitimate projects that were hijacked, and the malicious code was injected only into the published tarballs.

3mo ago · step-security

On July 24, 2026, a compromised PyPI package, mrmustard 0.7.4, was found to contain a credential-stealing payload that activates upon import. The attacker hijacked a maintainer's GitHub account, stole CI secrets to gain PyPI publishing rights, and uploaded the malicious version without modifying the public source repository. The payload exfiltrates SSH keys, cloud credentials (AWS, Kubernetes), and system information, while establishing multiple persistence mechanisms on the infected host.

3mo ago · step-security

StepSecurity's mid-year report for 2026 highlights a significant increase in software supply chain attacks, driven by the adoption of AI by both developers and attackers. Attackers are shifting left, targeting development pipelines, CI/CD systems, and developer machines with increased efficiency and lower barriers to entry. The report emphasizes the importance of layered security controls across the entire software development lifecycle to proactively prevent and rapidly detect compromise.

3mo ago · step-security

Threat actors are increasingly targeting GitHub Actions secrets through campaigns like GhostAction and Megalodon, which exfiltrated thousands of secrets from public repositories. These attacks exploit the accumulation of unused, stale, or long-lived credentials that organizations fail to clean up. The Shai-Hulud worm exemplifies the risk, spreading by stealing npm tokens to publish malicious packages. Transitioning to OIDC-based authentication and eliminating unused secrets can reduce the attack surface significantly.

3mo ago · step-security

Between July 18 and July 19, 2026, a coordinated supply chain attack dubbed SleeperGem compromised three RubyGems packages: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. These malicious packages act as loaders, downloading a second-stage payload from an attacker-controlled Forgejo instance and installing a persistent backdoor on developer machines. The malware evades detection in CI environments by checking for CI-specific environment variables and only activates on developer laptops, where it establishes persistence via systemd and cron, and may escalate privileges by planting a setuid root shell.

3mo ago · step-security

Harden-Runner v2.20.0 now extends egress block mode to macOS and Windows GitHub-hosted runners, enabling organizations to prevent secret exfiltration across all operating systems used in CI/CD pipelines. This update addresses critical attack vectors seen in campaigns like Megalodon and GhostAction, where compromised workflows or dependencies exfiltrated secrets via outbound calls. Previously limited to audit mode on non-Linux runners, teams can now enforce network policies to block unauthorized egress traffic, strengthening supply chain security.

3mo ago · step-security

Supply chain attacks targeting GitHub Actions workflows pose consistent risks regardless of the runner infrastructure used. Third-party runner providers like Bitrise, Blacksmith, Depot, Namespace, and Warp are increasingly adopted for performance and specialized hardware, but they inherit the same threat model as GitHub-hosted runners. Malicious dependencies or compromised actions can still access sensitive secrets and execute harmful payloads. Harden-Runner v2.20.0 now supports these third-party runners, providing runtime security through egress monitoring, policy enforcement, and threat detection.

3mo ago · step-security

The article discusses the introduction of Device Policy by StepSecurity to help security teams enforce approved VS Code extensions across developer fleets. It highlights recent threats involving malicious IDE extensions, such as the IoliteLabs campaign and compromised Nx Console extension, which have led to backdoors and API key theft. The solution enables allow-listing of extensions using native IDE policies enforced via MDM or a standalone agent, ensuring tamper-resistant governance without requiring a proprietary enforcement layer.

3mo ago · step-security

A coordinated supply chain attack compromised two AsyncAPI GitHub repositories on July 14, 2026, by injecting malicious code into the CI/CD pipelines. The attacker gained push access to the 'next' and 'master' branches, leveraging legitimate GitHub Actions workflows to publish four malicious npm packages without stealing tokens. These packages delivered an obfuscated dropper that downloads and executes the Miasma RAT, a sophisticated payload with multi-channel C2 capabilities, credential harvesting, AI tool poisoning, and worm-like propagation features. The attack bypassed trust mechanisms like SLSA provenance by abusing authorized pipelines, highlighting risks in CI/CD security.

3mo ago · step-security

On July 11, 2026, a malicious version (8.14.0) of the jscrambler npm package was published, containing a preinstall hook that drops and executes a platform-specific native binary on Linux, Windows, and macOS. The payload, hidden inside a file named dist/intro.js with a custom magic header, is a Rust-compiled binary designed to steal browser credentials and cryptocurrency wallet data. The attack leverages kernel-level capabilities on Linux via eBPF, anti-analysis techniques on Windows and macOS, and communicates with known malicious domains and IPs. The compromised package represents a high-impact supply chain attack targeting development and CI/CD environments.

3mo ago · step-security

On July 8, 2026, attackers compromised a trusted developer's account to inject a backdoor into the @injectivelabs/sdk-ts npm package, a core SDK for the Injective blockchain. The malicious code captured cryptocurrency wallet recovery phrases and private keys during wallet creation or loading and exfiltrated them to an attacker-controlled server disguised as legitimate infrastructure. The backdoor was distributed across 18 related npm packages for less than an hour before being detected and reverted, posing a significant risk to any application that installed the tainted versions during that window.

3mo ago · step-security

Recent supply chain attacks such as GhostAction, Megalodon, Miasma, and Hades have exploited stolen GitHub tokens to inject malicious workflows into repositories, enabling secret exfiltration via CI runners. These attacks bypass branch protection and code review by committing to temporary branches without pull requests, evading detection. The malicious workflows harvest repository secrets—including cloud credentials, SSH keys, and OIDC tokens—and exfiltrate them using seemingly legitimate GitHub Actions workflows. StepSecurity introduces a two-layer defense: blocking unreviewed workflows from accessing secrets and detecting exfiltration attempts in real time.