github - AlphaHunt Converge

breach

[BREACH] The Extension Had the Keys

The plugin had keys. A VS Code extension sat beside repos, tokens, terminals, and AI configs. That is not just productivity. That is inherited access.

deep research

[DEEP RESEARCH] TeamPCP’s CI/CD Trust Inversion: When “Pinned” Actions Become Initial Access

A lot of teams “secured” Actions by pinning to tags. Great plan, right up until the trusted scanner becomes initial access. CI trust is now flimsy in ways most incident playbooks still ignore.

github

Unveiling Supply Chain Threats: Charming Kitten and Lazarus Group's Tactics

A recent GitHub supply chain attack on March 17, 2025, compromised a GitHub Actions tool, affecting 23,000 organizations. This incident highlights the vulnerability of software development tools, with attackers altering code to leak secrets.