Two actions-cool GitHub Actions hijacked on May 18 came back online on September 16, still serving the Mini Shai-Hulud stealer to tag-pinned workflows. Only workflows pinned to a pre-May 18 commit SHA escaped; the rest have CI secrets to rotate.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 47%
- Investor
- Investor 10%
Reality
- Evidence60
- Adoption40
- Hype gap+15
- Incentives30
- Confidence65
Superior crew slips wallet-drainers into browser extensions on the version bump
Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.
Reality
- Evidence60
- Adoption35
- Hype gap+10
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher A Firefox extension arms itself five seconds after install from a lookalike Google domain
The add-on shipped to Mozilla's store as a dispatcher and took its instructions afterwards from a page it opened itself, on a domain built to resemble googleusercontent.com.
Reality
- Evidence62
- Adoption10
- Hype gap−10
- Incentives55
- Confidence58
A DPRK-linked package campaign has started publishing to HashiCorp's Terraform Registry
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
- Evidence66
- Adoption21
- Hype gap+14
- Incentives72
- Confidence58
buildOne report1 publisher Chrome's auto-update default distributed the drainer once the extension changed hands
Socket says the sharpest move in this campaign was buying utilities that already had users, then shipping the payload as version two. Install-time review had already run and passed, and the 80,000-user surface came with the purchase.
Reality
- Evidence62
- Adoption54
- Hype gap+14
- Incentives71
- Confidence58