Packagist packages hid malicious package.json scripts, enabling Linux binary execution during installs and workflows.
A GitHub employee installed a routine VS Code extension update, handed cybercrime group TeamPCP enough access to exfiltrate ...
Reported over three years ago and allegedly still not properly fixed, the vulnerability enables attacks to execute JavaScript ...
GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks that has impacted hundreds of organizations.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results