StepSecurity

Secure your GitHub Actions with StepSecurity: Your Trusted CI/CD Security Partner

[StepSecurity @step_security]

🚨 Last week, North Korean state actors hijacked axios on npm. 300M+ weekly downloads. Turned into a remote access trojan.
We just published the behind-the-scenes story of how we detected it, fought the threat actor in real time, and helped the community respond.

[StepSecurity @step_security]

🚨 Breaking: 31 npm packages from @RedHat have been compromised.

100,000+ weekly downloads affected. The upstream CI/CD pipeline was compromised, with all packages published via GitHub Actions OIDC.

The payload:
⚠️ Reads GitHub Actions runner process memory to extract masked secrets
⚠️ Sweeps credentials across AWS, GCP, Azure, K8s, Vault, and npm
⚠️ Self-propagating worm that republishes backdoored packages using stolen npm tokens, bypassing 2FA
⚠️ Persists on dev machines via Claude Code settings hijack and VS Code task injection
⚠️ Exfiltrates data through GitHub API commits, blending in with normal git operations

We have responsibly disclosed the incident to the maintainers.

Full technical analysis: https://t.co/63nZYH1cMO

[StepSecurity @step_security]

🚨 Active npm supply chain attack. 143 packages compromised in a single coordinated wave across the AntV (Alibaba) data visualization ecosystem, plus echarts-for-react, timeago.js, jest-canvas-mock, and others. Some ship over a million downloads per month.

🛡️ The C2 domain sits on the same infrastructure used in the actions-cool/* GitHub Actions compromise we reported earlier today. Every StepSecurity Harden-Runner customer, community tier and enterprise, was protected from second zero of this incident via our global block list.

🚨 We pushed a Threat Center alert to all StepSecurity enterprise customers with detection queries and remediation steps.

Here's how StepSecurity Enterprise customers are protected at every stage of the software development pipeline:

⚙️ CI/CD pipelines
1️⃣ Outbound connections to the C2 domain are blocked automatically
2️⃣ Runner.Worker memory read detection flags attempts to dump CI/CD secrets

📦 Code Repositories
1️⃣ npm package search detects compromised packages in default branches and pull requests
2️⃣ npm cooldown and compromised package GitHub checks automatically block pull requests from being merged

💻 Dev Machine Guard
1️⃣ npm package search detects compromised packages installed on developer machines.

🔒 For all stages, StepSecurity Secure Registry blocks these compromised packages from even reaching your environment in the first place.

https://t.co/egNcqXRLke

[StepSecurity @step_security]

🚨 ACTIVE SUPPLY CHAIN ATTACK 🚨

The actions-cool/issues-helper GitHub Action is compromised. Every existing tag in the repo now points to an imposter commit that:

⬇️ Downloads the bun JS runtime
🧠 Reads Runner.Worker process memory to harvest CI/CD secrets in flight
📡 Exfiltrates credentials to t.m-kosche[.]com

Any workflow referencing this action by version will pull the malicious code on its next run.

If you use it: stop immediately, pin to a known-good commit SHA from before the compromise, and rotate any secrets exposed to recent runs.

StepSecurity customers are already protected:
🛡 Real-time Threat Center alert with "Am I Affected?" links for every workflow and every runner that has talked to the IOC domain
🚫 Compromised Actions Policy blocks any run referencing this action before it executes
🌐 Harden-Runner Global Block List now blocks t.m-kosche[.]com automatically, even in audit mode, no config change required
🔍 Imposter Commit detection flags the exact signature of this attack

Full advisory and IOCs:
https://t.co/D0pYzREDDZ

[StepSecurity @step_security]

🚨 BREAKING Nx Console VS Code Extension Compromised 🚨

Nx Console (nrwl.angular-console) v18.95.0, a VS Code extension with 2.2M+ installs, was published with malicious code on May 18, 2026. The compromised version executes an obfuscated credential stealing payload on workspace activation.

If you use Nx Console, assume your machine is compromised and follow your incident response process.

Our team is actively investigating and will keep the blog post updated as new details emerge:
https://t.co/BaHLzPzP6d

#SupplyChainSecurity #VSCode #CyberSecurity #DevSecOps

[kidneyweakx @kidneyweakx]

why this happened every day

[seslly @seslly]

server side javascript might die with this pace of CVEs

[StepSecurity @step_security]

🚨 BREAKING: node-ipc compromised. Again.
Three malicious versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were published today carrying an identical credential-stealing payload. This package has 10M+ weekly downloads.

Here's what happened:
An attacker injected an 80KB obfuscated IIFE into the CommonJS bundle. It fires on every require('node-ipc') call. No special config needed, just importing the package is enough.

What it steals: → AWS, Azure, GCP credentials → SSH private keys → Kubernetes configs → Docker tokens → GitHub CLI tokens → AI tool configs (including Claude) → Terraform state → 90+ credential file patterns in total

Everything gets gzipped and exfiltrated to an attacker-controlled domain (sh[.]azurestaticprovider[.]net) via DNS TXT queries and HTTPS POST, designed to look like normal traffic.

The attacker published across two major version lines simultaneously (9.x and 12.x) to maximize blast radius. Semver ranges like ^9, ~9.1.x, ~9.2.x, ^12, and ~12.0 all resolve to compromised versions automatically on the next install or lockfile refresh.
Key details:
Only the CommonJS bundle (node-ipc.cjs) is affected. ESM imports are clean.
The 9.x releases are fabricated. The 9.x line never shipped a .cjs bundle before this attack.
This is a different actor from the 2022 peacenotwar incident. Purely financial, credential-theft motivation.
If you installed any of these versions, assume all secrets on that machine are compromised. Rotate everything.
Our full technical breakdown covers the attack chain stage by stage, IOCs, and how to check if you're affected:
https://t.co/l7m03coFQu

[StepSecurity @step_security]

🚨 ACTIVE INCIDENT: The Mini Shai-Hulud worm is back, and it just compromised dozens of official @tanstack npm packages

This is the first documented self-spreading npm worm that carries valid SLSA provenance attestations. Let that sink in.

Our OSS Package Security Feed detected the compromised releases and we're tracking the spread in real time.

Here's what happened:

The attacker staged an obfuscated 2.3 MB credential-stealing payload in a fork of TanStack/router, then used hijacked OIDC tokens to publish malicious versions through TanStack's own legitimate GitHub Actions release pipeline.

The compromised packages include @tanstack/react-router, @tanstack/router-core, @tanstack/react-start, and 40+ other packages. Millions of weekly downloads across the ecosystem.

If you installed any affected version in CI, assume all secrets in that environment are compromised. Rotate tokens immediately.

Full technical analysis, IOCs, compromised version list, and recovery steps on our blog. The list of affected packages is still growing.

https://t.co/kRiwPD0JGx

[StepSecurity @step_security]

Our co-founders Varun Sharma and Ashish Kurmi are heading back to @Microsoft next week, this time as speakers at BlueHat Redmond. Both started their security careers at Microsoft, so it's a full-circle moment. If you'll be there, stop by and say hi!

[Microsoft BlueHat @MSFTBlueHat]

🎤 BlueHat Speaker Announcement

We’re excited to announce that Varun Sharma, Co-founder & CEO, StepSecurity and Ashish Kurmi, Co-founder & CTO, StepSecurity, will be speaking at BlueHat with their session, “Double‑Edged AI: Securing the Software Supply Chain in the Autonomous Era.”

In this talk, Ashish and Varun analyze major 2025 software supply chain attacks, including the tj-actions compromise, the Nx s1ngularity attack (the first known malware to weaponize AI coding agents), and the Shai-Hulud npm worm series. They explore how AI is reshaping the threat landscape, acting on both sides by accelerating development while also enabling more sophisticated, self‑propagating attacks.

The session concludes with a vendor‑agnostic defense framework covering CI/CD security, credential management, and AI coding agent governance. Attendees will gain practical insight into how to secure modern software supply chains in an era where autonomous systems are increasingly part of both development and attack workflows.

[StepSecurity @step_security]

🚨 A Mini Shai-Hulud has appeared.

Your npm install just handed your credentials to an attacker.

We detected a new supply chain campaign targeting SAP developer packages. It downloads Bun (not Node) to run an 11 MB obfuscated payload. Victim repos are being created on GitHub as we speak.

Full breakdown: https://t.co/j2GcVsgJWc

[StepSecurity @step_security]

The full behind-the-scenes story, the frantic evening, the deleted issues, the community rallying at midnight, is on our blog.
Read it here: https://t.co/5whpAp14KI

[StepSecurity @step_security]

🚨 Last week, North Korean state actors hijacked axios on npm. 300M+ weekly downloads. Turned into a remote access trojan.
We just published the behind-the-scenes story of how we detected it, fought the threat actor in real time, and helped the community respond.

[StepSecurity @step_security]

→ @karpathy shared our blog on X, calling it the "more comprehensive article"
→ @firaborjmshi featured our analysis. 624K+ views.
→ Hit #1 on Hacker News for hours

[StepSecurity @step_security]

🚨 @poweredbyClubs your dev-protocol GitHub org has been compromised. Attackers are distributing fake Polymarket bots that steal wallet private keys via typosquatted npm packages.
Details: https://t.co/LNgOy1EQak

[StepSecurity @step_security]

Hackerbot-Claw: AI Bot Exploiting GitHub Actions – Microsoft, Datadog Hit So Far

Full breakdown of the 5 attack techniques with evidence: https://t.co/EhU3sYnOwX

[StepSecurity @step_security]

5/5 This is the second CI/CD supply chain attack detected by Harden-Runner in 2024. Earlier, it caught an exploit in Google’s open-source project, Flank.
Check out the full case study and video of the Azure Karpenter project for all the details: https://t.co/PN5HX0kj29

[StepSecurity @step_security]

1/5 All #GitHub Actions workflows in the @Microsoft Azure Karpenter Provider project have been secured with StepSecurity’s Harden-Runner since January 2024. Here's how Harden-Runner detected a potential supply chain attack in real-time. 👇

[StepSecurity @step_security]

4/5 We’re honored to be recognized on Microsoft’s acknowledgment portal for our contribution to securing their online services. Following this exploit, the repository now uses Harden-Runner in block mode, preventing unauthorized outbound calls that aren't on the allowed list.🙌