-
Megalodon and the CI/CD trust problem
5,561 repos got malicious GitHub Actions workflows in six hours. No zero-day, just a merge. Detection and change-control guidance for defenders.
-
Your IDE is in the supply chain now: the GitHub 3,800 Repo Exfiltration Dissected
GitHub confirmed ~3,800 internal repos exfiltrated via a poisoned VS Code extension. We separate vendor-confirmed facts from campaign reporting and inference.