LiteLLM Master Key Leak Enables GitHub Token Theft and Release Pipeline Hijack
A leaked LiteLLM master key exposed a GitHub OAuth token, enabling attackers to steal organization tokens and publish malicious releases.
github
4 stories
OVHcloud GitHub Compromise Reveals GlassWorm Activity
OVHcloud’s GitHub account was accessed by actors linked to the GlassWorm threat group, resulting in credential theft and malicious code injection into private.
GhostAction GitHub Actions Credential-Stealing Workflows Planted in 34,000+ Repositories
GhostAction injected malicious GitHub Actions workflows into over 34,000 repositories, exfiltrating secrets via plain HTTP to a hard-coded IP.
TanStack npm supply chain attack fuels CrowdSec breach of 170 private repos
The TanStack npm supply chain attack harvested a GitHub token that allowed an ex-employee to copy 170 private CrowdSec repositories, exposing code.