buildConfirmed2 publishers GhostAction attackers used roughly 1,900 hijacked GitHub accounts to plant credential-stealing workflows in over 30,000 repos. No GitHub Actions flaw was involved, so defence means rotating exposed keys and reviewing who edits workflows.
Perspective Coverage
3 publishers
- Builder
- Builder 38%
- Operator
- Operator 52%
- Investor
- Investor 10%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence72
buildOne report1 publisher Chainguard runs coding agents in remote microVMs and proposes signed attestations as the merge gate
Chainguard has launched two beta products, Workspaces and Checks, that run coding agents in remote microVMs and move CI into the dev loop. Keeping agents off laptops that hold corporate credentials costs teams a dependency on Chainguard's execution and signing system, InfoQ reported.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence45
buildOne report1 publisher GhostAction's workflow pulls a repository's full git history to search old commits for keys, a dev.to author says
GhostAction's fake workflow sets fetch-depth: 0 and runs git log -p --all, so deleted secrets are in reach, a dev.to author reports. A credential removed from the current files is still in every earlier commit, so it has to be revoked at the provider.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher npm worms ran attacker code from committed Claude Code hooks
Worms spreading through npm in May and June 2026 committed a SessionStart hook to .claude/settings.json that runs a script when Claude Code opens the repo. Removing the package leaves that file in place, a dev.to write-up says.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence55
buildConfirmed2 publishers Tensorlake's npm SDK 0.5.144 carried a Shai-Hulud worm on October 8 that steals GitHub and npm tokens, cloud keys and AI coding-tool configs. A dev.to write-up of StepSecurity's teardown says revoking the stolen GitHub token triggers an rm -rf ~/, so the service must go first.
Publishers:dev.to · endorlabs.com Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence62
GhostAction's credential-stealing GitHub workflow has reached tens of thousands of repositories through more than 500 accounts since October 7, Socket says. Any repository carrying the file should be treated as having lost its Actions secrets and every key in its git history.
Reality
- Evidence58
- Adoption70
- Hype gap+8
- Incentives
- Not scored
- Confidence62
buildConfirmed4 publishers Tensorlake's npm SDK 0.5.144 runs a credential-stealing worm from a preinstall hook at install time, Socket reported. According to Socket's analysis, any secret reachable from a workstation or build runner that installed the release may be exposed.
Perspective Coverage
4 publishers
- Builder
- Builder 44%
- Operator
- Operator 50%
- Investor
- Investor 6%
Reality
- Evidence74
- Adoption25
- Hype gap+10
- Incentives35
- Confidence72
Two men arrested in Australia this week are alleged TeamPCP members. The AFP estimate filed alongside the case puts the worm's take at more than 500,000 credentials and 300GB of data, and that scale makes token lifetime the live question.
Perspective Coverage
16 publishers
- Builder
- Builder 29%
- Operator
- Operator 56%
- Investor
- Investor 15%
Reality
- Evidence62
- Adoption68
- Hype gap+30
- Incentives58
- Confidence70
buildOne report1 publisher Fake Polymarket copy-trading bots hid key stealers in their npm dependencies
One attacker pushed more than twenty malicious GitHub repos from a hijacked account in February, several posing as Polymarket copy-trading bots. Garnet's maintainer published a fifteen-minute checklist for tracing what a bot does with the one signing key it needs.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives70
- Confidence40
Malicious versions of three Rust crates ran code at compile time on August 20. Wiz says the infrastructure overlaps with DPRK operations, so the campaign should be treated as live.
Perspective Coverage
6 publishers
- Builder
- Builder 45%
- Operator
- Operator 48%
- Investor
- Investor 7%
Reality
- Evidence80
- Adoption30
- Hype gap+25
- Incentives55
- Confidence75
buildConfirmed6 publishers The Rust Security Response Team deleted proc-macro1 and arrayref 0.3.10 on August 20 after a build script fetched and launched a binary. The lure was a yank warning.
Perspective Coverage
7 publishers
- Builder
- Builder 38%
- Operator
- Operator 54%
- Investor
- Investor 8%
Reality
- Evidence86
- Adoption15
- Hype gap+35
- Incentives60
- Confidence82
Three versions of MemTensor's MemOS Cloud plugin on npm and MemoryOS 2.0.34 on PyPI launch a Go stealer called sckit that reads the host environment and the user's prompt text, and the npm versions are still installable.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence64
buildOne report1 publisher A predictable pnpm cache key carried fork code into TanStack's npm release workflow
TanStack's postmortem says 84 malicious versions went out across 42 packages on 2026-05-11 with no npm token stolen, because a release job restored a cache that an untrusted pull_request_target build had written.
Publishers:tanstack.com
Reality
- Evidence68
- Adoption45
- Hype gap+6
- Incentives65
- Confidence58
UAC-0099 hid a nuclear-weapons request in a VBScript comment to stall an LLM code scanner
ESET calls the technique GuardBreaker and notes that this bait, unlike most evasion tricks, is left in plain sight for the models reading the code to find.
Reality
- Evidence58
- Adoption32
- Hype gap+22
- Incentives68
- Confidence60
SecurityBridge's co-founder makes the SAP agent case on one survey and two prior incidents
Ivan Mans of SecurityBridge says the SAP security question is now what an agent already inside the system is allowed to do and whether anyone can prove it afterward. His incident record comes from developer tooling.
Reality
- Evidence33
- Adoption28
- Hype gap+38
- Incentives84
- Confidence64
Shai-Hulud's third wave printed SAP's npm token straight into a workflow log
Four core SAP build packages shipped an identical 11.6MB credential stealer. Because npm trusted the whole cap-js repository rather than one branch, a commit pushed to an unused branch was enough to publish them.
Publishers:stepsecurity.io
Reality
- Evidence60
- Adoption38
- Hype gap+15
- Incentives78
- Confidence55
A poisoned Nx Console build rode VS Code's auto-update into GitHub's own repositories
CISA says a trojanized extension version, 18.95.0, reached a GitHub employee's machine without anyone installing it, and internal repositories left from there. CVE-2026-48027 is now in the KEV catalog.
Reality
- Evidence76
- Adoption58
- Hype gap−8
- Incentives24
- Confidence74
buildOne report1 publisher 56 build-pipeline attacks, one vendor's alert queue, and the February jump nobody can attribute yet
StepSecurity's first annual report logs 56 confirmed supply chain compromises and says plainly that these are its own alerts. The February change is the finding; explaining it is the hard part.
Reality
- Evidence46
- Adoption42
- Hype gap+16
- Incentives79
- Confidence51
buildOne report1 publisher An eBPF egress filter for GitHub Actions that ships with no backend and states what it won't do
field-cage blocks outbound connections from Linux runners in the kernel, keeps its logs on the box, and disclaims step correlation, tamper detection and organization-wide visibility.
Reality
- Evidence34
- Adoption9
- Hype gap−12
- Incentives46
- Confidence36
The arrayref compromise turned cargo update into the delivery channel
Wiz says a compile-time payload reached builds through a typosquatted dependency, and the attacker yanked every clean arrayref release so the responsible fix resolved to the poisoned one.
Reality
- Evidence66
- Adoption74
- Hype gap+12
- Incentives62
- Confidence58