We had a security incident on Tensorlake today. There was no impact to customer information such as API keys or sandboxes. An application running on an upstream provider spins up sandboxes in our engineering team’s accounts and runs automation workflows. These sandboxes had access to our GitHub repositories. The attacker pushed malicious code to branches and triggered GitHub Actions to probe for secrets that workflows can access to build and deploy code. The upstream provider had a security breach a couple of weeks ago that exposed our environment variables. We had not rotated those env vars, as this is not a critical application for our production environment. This was an oversight, we should have acted on this immediately. We have no evidence that any critical systems were accessed beyond probing for secrets. We have rotated all secrets and undeployed the internal application from the upstream provider. Out of abundant caution, please rotate your Tensorlake API keys. We will share more information with customers over email and post updates in our trust center. We have already notified all paying customers by email, and we will follow up with additional details.
GitHub
Security incidents tagged GitHub. Newest first.
15 GitHub incidents in the last 12 months
- Incidents
- 22
- Live
- 9
- Patched
- 11
- Days without an incident
- 0
- Longest quiet run: 442 days (Sep 19–Dec 3)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- LiveHighPartly patchedBreaches
Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env vars
On Nov 8 2026 Tensorlake founder Diptanu Choudhury disclosed a security incident. He said an application running on an upstream provider spun up sandboxes in Tensorlake engineering-team accounts that had access to the company’s GitHub repositories; an attacker pushed malicious code to branches and triggered GitHub Actions to probe for secrets those workflows can access. The first published version of the post named the provider as Railway; later edits of the same post say “an upstream provider” and add that the provider had a security breach a couple of weeks earlier that exposed environment variables, that Tensorlake had not rotated those env vars because the application was not critical for production, and that this was an oversight. He said there was no impact to customer information such as API keys or sandboxes, that Tensorlake has no evidence any critical systems were accessed beyond probing for secrets, that it has rotated all secrets and undeployed the internal application, and that paying customers have been notified by email. Out of abundant caution he asked customers to rotate Tensorlake API keys. Further details are promised by email and on Tensorlake’s trust center. This is separate from the October 2026 tensorlake npm Shai-Hulud worm.
Tensorlake (AI sandbox platform)Since Nov 8, 2026
- LiveHighNo patch yetPatch now
Claude Code "don't ask again" file leaks passwords and keys: 1,122 public copies of .claude/settings.local.json on GitHub hold secrets
When a Claude Code user picks "Yes, and don't ask again" on a shell command, Claude Code can save the exact command, including any password or token typed into it, as an allow rule in .claude/settings.local.json in the project. Claude Code adds that file to the user's global git excludes on one machine, but never to the project's own .gitignore, and does nothing for a file that is already tracked. Apiiro researchers Shmulik Cohen and Matan Giladi published research on Nov 5 2026 that found 104,185 public copies of the file on GitHub, 1,122 of them (about 1.1%) holding at least one secret, 1,379 distinct secrets in total, including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens and 23 AWS keys. Counting git history, the shared .claude/settings.json and saved agent chat logs, they counted 2,539 secrets across 1,994 repositories. Apiiro did not test the credentials, but one notified company confirmed its key had been live. Earlier bug reports about the behavior were closed by an automated bot without a reply from Anthropic.
Anthropic Claude Code (.claude/settings.local.json permission allow rules)Since Nov 5, 2026
- LiveHighPartly patchedPatch now
EMBRACE: built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop broken, Codex and VS Code still unpatched
Forever Security published research on Oct 29 2026, which it calls EMBRACE, showing that the browsers built into five AI coding assistants let a web page or a local file reach the computer behind them. In Cursor a booby-trapped page got the agent to run a command on the host with a single Enter (fixed Oct 1). In GitHub Copilot a page could spoof the address bar to show github.com to both the user and the agent (fixed in Copilot 1.1.29). In Codex, VS Code and Claude Desktop a single local HTML file opened in the built-in browser could read and exfiltrate any file on the disk, such as SSH keys, .env files and npm tokens. Codex and VS Code had no fix at publication: Microsoft declined the report citing Workspace Trust, and OpenAI never replied.
Embedded browsers in AI coding assistants (Cursor, GitHub Copilot, OpenAI Codex, VS Code, Claude Desktop)Since Oct 29, 2026
- ClosedPatchedSupply chain
OVHcloud CLI releases backdoored on GitHub
On Oct 19 2026 a compromised OVHcloud developer GitHub account swapped the release binaries of ovhcloud-cli v0.11.0 to v0.15.0 for a credential stealer for about 1.5 hours (~250 downloads). Anyone who installed from GitHub releases between 12:47 and 14:21 UTC that day should treat the machine as compromised and rotate every secret it could read; v0.16.0 is clean.
OVHcloud CLI (GitHub releases)Closed Oct 20, 2026
Show 18 older incidents18 older incidents
October 2026 4
- LiveHighPartly patchedSupply chain
Backdoored ARTEX Docker image (tomicdd/artex) gives anyone an unauthenticated root shell
After the author of ARTEX, an open-source AI penetration-testing console abused in attacks on banks, took the GitHub repository down on Oct 8 2026, a copycat repository (trhhubsd/ARTEX, the most-starred copy) changed one line in docker-compose.yml to pull a Docker Hub image, tomicdd/artex, pushed the same day. BadByte found that the image's binary, unlike the clean GitHub source, adds a hidden verifyCaptcha() function to the login handler: if the CAPTCHA field starts with a secret marker, the rest runs through sh -c as root and the output is returned, before any credential check. The image had 7,946 pulls by Nov 3 (about 9,000 by Nov 5), 637 GitHub repositories still pointed their compose file at it, and 62 internet-facing consoles served the backdoored build between Nov 2 and 4. congdonglinux/artex is a byte-identical re-push. If you ran either image, treat the host and every key in the container (database password, LLM and search API keys, harvested target credentials, JWT signing key) as compromised, rebuild from reviewed source and keep the console off the open internet.
ARTEX AI penetration-testing console, Docker images tomicdd/artex and congdonglinux/artexSince Oct 8, 2026
- LiveHighPartly patchedSupply chain
GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos
GhostAction, a campaign first documented by GitGuardian in Sept 2025, came back in 2026. It hit 772 repos in Aug-Sep 2026, then surged on Oct 8-12: about 1,900 compromised GitHub accounts pushed fake 'security audit' workflows to 30,000+ repositories (GitGuardian). The new payload exfiltrates the repo's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around Oct 9. The operator moved on to GitHub-themed phishing (my-github.com) and a VS Code tasks.json + fake .woff2 font stealer found in 94 repos.
GitHub repositories / GitHub Actions (compromised maintainer accounts)Since Oct 8, 2026
- LiveCriticalPartly patchedSupply chain
tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token
On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.
tensorlake (npm)Since Oct 7, 2026
- ClosedPatchedSupply chain
SubQuery @subql/common 5.8.3 published with credential stealer + backdoor
On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.
@subql/common (npm) and downstream @subql/* packagesClosed Oct 10, 2026
September 2026 2
- LiveHighPartly patchedSupply chain
Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repo
Since Sep 15 2026 an automated campaign Wiz calls Gheist (after its 'gheist' API user agent) has used compromised GitHub tokens to commit a 'sync-check' workflow to every repository each token can reach. The workflow prints the repo's secrets base32-encoded so GitHub's log masking misses them, then the tool downloads the log and deletes the run, with no C2 server. Wiz recovered 13,500+ planted branches from 850+ accounts. GitHub's approval hold stops it in public repos, but it has run successfully in private repos and GitHub Enterprise Server. A newer job also sweeps self-hosted runner hosts for credentials. Wiz says it is distinct from GhostAction. As of Oct 24 about two-thirds of the accounts involved were no longer available on GitHub.
GitHub repositories / GitHub Actions (compromised tokens)Since Sep 15, 2026
- LiveMediumPartly patchedSupply chain
GitHub issue and PR payloads hit 61 repos including Trivy, Brave and MLflow in a 43-minute workflow injection campaign
Radware found a coordinated campaign on Sept 1 2026: 83 issues, pull requests and comments, posted from 74 GitHub accounts (many likely compromised), aimed at 61 public repositories including Trivy, Brave, MLflow, Google LangExtract, CopilotKit, podman, cilium and Homebrew Cask. 77 of them landed within 43 minutes. Each carried a $() shell command that runs if a GitHub Actions workflow pastes the issue or PR text into a shell step, collecting the job's environment variables and sending them to an attacker server. The item doesn't need to be merged or even stay open. Run logs show the command executed in two cases; whether any tokens with write access were stolen or code changed is unknown. Maintainers were notified and most repos were fixed.
GitHub Actions workflows in public repositoriesSince Sep 1, 2026
August 2026 1
CriticalCHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)Supply chainPartly patched
npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages) Partly patched
In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.
July 2026 1
- LiveHighPartly patchedSupply chain
testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads
JFrog found that the testmetest npm worm campaign (a Shai-Hulud-descendant credential stealer that SafeDep first documented on Oct 22 2026) had already armed 42 GitHub repositories across 11 legitimate owners. Planted Claude, Gemini, Cursor and VS Code hooks run a .github/init.js wrapper of 12.9 to 13.7 MB, too big for GitHub code search and the contents API to see, that decodes to an npm publisher abusing GitHub Actions OIDC trusted publishing. Remove the malicious testmetest and @iobandamwer packages, treat hosts that installed them as compromised, remove the net-health-checker and pkg-runtime persistence before revoking tokens (the worm wipes ~/ on revocation), and audit repos for the hook files.
npm *-testmetest and @iobandamwer packages, hijacked GitHub repositoriesSince Jul 23, 2026
May 2026 1
CriticalMini Shai-Hulud hits AntV / timeago.js npm ecosystemSupply chainPartly patched
npm @antv/*, timeago.js, related packages under atool Partly patched
May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.
March 2026 1
PatchedTeamPCP supply-chain campaign: Trivy → Checkmarx GitHub ActionsSupply chain
Aqua Trivy, trivy-action, setup-trivy, Checkmarx AST/KICS GitHub Actions, related Docker/VS Code artifacts
Threat actors tracked as TeamPCP compromised Trivy releases and GitHub Actions (including trivy-action / setup-trivy), then expanded into Checkmarx AST and KICS Actions and related artifacts. Malware stole CI/CD credentials (exfil as tpcp.tar.gz). Microsoft, Sysdig, CSA Singapore and Checkmarx published guidance in March 2026.
November 2025 1
- ClosedPatchedSupply chain
Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS
A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.
npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)Closed Nov 26, 2025
September 2025 1
- ClosedPatchedSupply chain
Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike
A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.
npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)Closed Sep 23, 2025
August 2025 1
- ClosedPatchedSupply chain
s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed
Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.
nx and @nx/* npm packagesClosed Aug 29, 2025
March 2025 2
Patchedreviewdog action-setup GitHub Action: reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilitySupply chain
reviewdog action-setup GitHub Action
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs. Added to CISA KEV on 2025-03-24.
Open incident →CVE-2025-30154- ClosedPatchedSupply chain
tj-actions/changed-files compromised: CI secrets dumped in 23,000+ repos' logs
Attackers repointed the version tags of the popular tj-actions/changed-files GitHub Action to a commit that dumped runner memory, printing CI/CD secrets into workflow logs. It started with the compromise of reviewdog/action-setup and was aimed at Coinbase's agentkit repo first. Over 23,000 repositories used the action.
tj-actions/changed-files GitHub ActionClosed Mar 20, 2025
December 2024 1
PatchedUltralytics PyPI releases backdoored with a crypto minerSupply chain
ultralytics (PyPI)
Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.
June 2023 1
PatchedMicrosoft AI researchers exposed 38TB via an over-permissive Azure SAS linkBreaches
Microsoft Azure Storage (SAS token in a GitHub repo)
A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.
March 2023 1
PatchedGitHub's RSA SSH host key briefly exposed in a public repoSupply chain
GitHub (github.com SSH)
GitHub's private RSA SSH host key for github.com was briefly exposed in a public repository. GitHub rotated it as a precaution, which meant anyone connecting over SSH with RSA saw a host key mismatch warning until they updated known_hosts.
Posts 12
- Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env varsDiptanu Choudhury@diptanu
- Backdoored ARTEX Docker image (tomicdd/artex) gives anyone an unauthenticated root shellThe Hacker News@TheHackersNews
‼️ A backdoored AI hacking tool is exposing servers to root access without authentication. A malicious Docker image for ARTEX hides a root shell in its login handler. Researchers found 62 internet-facing consoles running the backdoored build. Read: t.co/JiUtfukLWG
- Backdoored ARTEX Docker image (tomicdd/artex) gives anyone an unauthenticated root shellBadbyte@NullPwner
🚨 We dug into the backdoored ARTEX Docker image. • 7,946 pulls of tomicdd/artex • 637 repos still pull it • 62 exposed consoles backdoored, 46 still live • 1,645 ARTEX consoles exposed across the internet Full write-up 👇 t.co/AoB3dc8bEM
- testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloadsThe Register@TheRegister
Too big to spot? An npm worm campaign planted malicious payloads in 42 GitHub repos, using oversized files to evade code search and routine API checks.
- testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloadsJFrog Security@JFrogSecurity
🚨 testmetest goes beyond npm. JFrog Security Research identified 42 armed GitHub repositories across 11 legitimate owners hiding an npm publisher, plus a new native addon that decrypts its payload at runtime and stays dormant in CI, sandboxes, and analysis tools. The campaign
- Gheist: stolen GitHub tokens plant secret-dumping 'sync-check' workflows in every reachable repoThe Hacker News@TheHackersNews
🚨 850+ compromised GitHub accounts. 13,500+ malicious branches. Researchers uncovered 'Gheist,' an ongoing campaign using stolen tokens to plant GitHub Actions workflows that dump private repo secrets into logs. Attackers download the logs, then delete the runs. Details: t.co/eu1KkQP2D7
+6 more on the incident pages above.