devtake.dev
AI Security Hardware Open Source Policy Apple

#cicd

RSS
Related: #supply-chain · 2 #aqua-security · 1 #bitwarden · 1 #checkmarx · 1 #credential-theft · 1 #devsecops · 1 #github-actions · 1 #npm · 1 #shai-hulud · 1 #teampcp · 1
Bitwarden CLI compromised by the Shai-Hulud npm worm
Security·

Bitwarden CLI got backdoored for 90 minutes. The worm calls itself 'Shai-Hulud: The Third Coming.'

A malicious @bitwarden/cli@2026.4.0 hit npm on April 22. The payload steals npm tokens, cloud secrets, and Claude Code credentials, then self-replicates.

Trivy logo, the open-source vulnerability scanner from Aqua Security
Security·

Trivy got hijacked: 75 of 76 version tags rewrote to drop a CI secret-stealer

Attackers force-pushed 75 of 76 trivy-action tags to a malicious commit. Pinning by tag turned a trusted scanner into an infostealer for CI pipelines.