Dan Le

Cybersecurity as a Service for defense fintech, healthtech, startups. 🦄 We make security & compliance easier. 😌 Founder of @RedCupIT 📍 SF

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: Another supply chain attack. 700+ GitHub repositories flagged, including PHP and Node.js projects. The malicious script was planted across all of them. When a developer installs the package, the script silently downloads a Linux file from GitHub, hides it under the name /tmp/.sshd (so it looks like a normal system file), and runs it in the background. It also skips security checks on the download and hides any error messages.

8 PHP packages on Packagist (the main PHP code library) were confirmed infected. The attacker hid the script inside a JavaScript config file (package.json) instead of the PHP one (composer.json), so PHP developers reviewing their code would not notice it. The biggest risk is to devdojo/wave (6,400 stars) and devdojo/genesis (9,100 installs), both popular Laravel project templates. Developers who use these templates run the bad script the moment they install dependencies.

The same payload was also dropped into GitHub Actions (automated build pipelines) under a fake step called "Dependency Cache Sync," meaning it could infect company build servers too. Packagist removed the bad packages, but the auto-updating versions (dev-main, dev-master, 3.x-dev) can quietly come back if the original repos stay infected.

IOCs:
GitHub account parikhpreyash4
repo systemd-network-helper-aa5c751f
drop path /tmp/.sshd
command fragments curl -skL and chmod +x /tmp/.sshd.

[Dan Le @danle]

@rootsecdev Yep

[Dan Le @danle]

Endpoint security and knowing what’s installed on your device is more important than ever.

Managing risk means controlling the flow of data into and out of your boundary, whether that’s your browser, IDE, VPS, SaaS, AI agent, or endpoint device.

BRB while I reformat all of our computers 🙂‍↔️

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[Dan Le @danle]

Wow. Goodbye supply chain security. Time to move to air-gapped repositories and CI/CD.

[GitHub @github]

2/ Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.

[EZ @IAMERICAbooted]

Modern Threat Modeling 101 Tip:

Before Mythos came out we warned everyone to go into turtle mode in case your late to the game (get everything off the internet as possible).

In case your super late to the game, get your employee SaaS apps off the internet. Almost all SaaS has SP-Initiated authentication built in to the implementation. Moreover, attackers are going to find authentication "bypasses" much easier now. SP-initiated authentication makes the SaaS enumerable from the internet for easy targeting.

Now is not the time to have things on the internet. MFA will not save you. We left that era a couple years ago.

You should be behind your SASE/ZTNA solution's dedicated IPs.

If you are not requiring managed assets to access cloud resources, rhat means your cloud resources are accessible from the internet. Understand now?

[Dan Le @danle]

@jimbelosic I just ran through 6 brick walls!! LFGGGGGG

CONGRATS!!

[Tuomas Artman @artman]

Today is a hard day. I shared this note with the @linear team today: We’ve made the difficult decision to increase our workforce. This is not a cost-cutting exercise or a reflection of anyone’s performance. We’re simply reimagining every role for the agentic AI era. We’re hiring. We’re sorry about that.

[Dan Le @danle]

@sporadica Datacenter hand me downs!

[Dan Le @danle]

@browser_use Would love a sweater! Can I swing by the SF office?

[Dan Le @danle]

@steipete Roasted lobster 🦞

[Dan Le @danle]

@benln @the_danny_g @LegionHealth mentioned!!!

[Dan Le @danle]

Had this exact conversation today!

[gian @giansegato]

kinda ironic how the average work day is getting _harder_, as we progressively automate the easier parts of our daily jobs offloading them to agents. net result is that the average complexity of the tasks we still get to do is actually increasing

insofar as we decide to still work the same number of hours (if not more), the more we offload to agents the harder our days will get

lots of obvious confounders so not exactly direct causality, but since opus 4.5 i feel so much more tired. i get to accomplish crazy more - probably now doing what last year would've considered 3-4 distinct jobs, all at the same time. but at what price?

pretty sure the current general anxiety in tech is not just that. could quite simply be lots of tiredness as we no longer get to code for hours in quiet flow, and have to uniquely narrow our focus to only the hardest pieces

(or maybe i'm just projecting because this race is killing me lmao)

[Dan Le @danle]

@tobi In 2026, CEO = Context Engineering Officer

[Dan Le @danle]

@UK_Daniel_Card @DrAzureAD Shhhhhhhhhhhhh!!! 🤐

[Dan Le @danle]

@garrytan Gotta code with 2 MacBook Pros to load balance! Haha

[Dan Le @danle]

@0x616775790 @cyb3rops There is no easy button 🙂‍↔️

[Dan Le @danle]

@cyb3rops This is so good and so true. Inspired to build today!!!!!

[Dan Le @danle]

@lucknite @openclaw @steipete @lucknite Worked with Claude to fix the codebase from a Purple Team perspective. Had it look at @elder_plinius repos for inspiration on how to harden

Submitted a PR where the score is now 100/100! https://t.co/uQ1vbViJNb

[Dan Le @danle]

@JustJake Very true! With the amount of new clawd skills and connections being built daily, the attack surface is growing exponentially

[Dan Le @danle]

@AlexFinn @ParikPatelCFA In 2026, we have Return to Office mandates for AI agents