The Register on MSN7h
That massive GitHub supply chain attack? It all started with a stolen SpotBugs tokenBut this mystery isn't over yet, Unit 42 opines That massive GitHub supply chain attack that spilled secrets from countless projects? It traces back to a stolen token from a SpotBugs workflow - ...
A cascading supply chain attack on GitHub that targeted Coinbase in March has now been traced back to a single token stolen ...
The threat actors initially attempted to compromise projects associated with the Coinbase cryptocurrency exchange, said Palo ...
Leaked SpotBugs PAT in November 2024 led to a GitHub supply chain attack, compromising Coinbase in March 2025.
Cryptopolitan on MSN15d
Coinbase fends off targeted GitHub Action attack in early-stage breach attemptAccording to the cybersecurity firms analyzing the incident, the attacker initially tried to compromise the Coinbase ...
GitHub supply chain attack GitHub Action' tj-actions/changed-files' was compromised by attackers who added a malicious commit on March 14, 2025, to dump CI/CD secrets from the Runner Worker ...
Evidence shows a SpotBugs token compromised in December 2024 was used in the March 2025 GitHub Actions supply chain attack.
Open source software used by more than 23,000 organizations, some of them in large enterprises, was compromised with credential-stealing code after attackers gained unauthorized access to a maintainer ...
We know a bit more about the GitHub Actions supply chain attack from last month. Palo Alto’s Unit 42 has been leading the ...
A supply chain attack on a GitHub Actions tool has put up to 23,000 organisations at risk of having credentials stolen. GitAub Actions is a CI/CD platform that automates code testing and deployment.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results
Feedback