Field notes from the edge.
What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.
AIGitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
GitHub is implementing breaking changes in npm version 12 that will disable install scripts by default as a security measure against supply chain attacks. This change specifically targets malicious actors who exploit npm lifecycle hooks to execute harmful code during the package installation process.
AIMicrosoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues
Microsoft temporarily removed several GitHub repositories following a security incident that compromised 73 of its open-source projects with information-stealing malware. The company is conducting an ongoing investigation while prioritizing customer and ecosystem protection, with some repositories restored and others remaining offline during the probe.
AIMiasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
Microsoft's GitHub repositories have been compromised in a significant supply chain attack involving the Miasma self-replicating worm. The attack affected 73 repositories across four Microsoft GitHub organizations including Azure, Azure-Samples, Microsoft, and MicrosoftDocs, prompting GitHub to disable access to the impacted repositories.
AIOne-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens
A critical security vulnerability in Microsoft Visual Studio Code allows attackers to steal GitHub OAuth tokens through a one-click attack. The exploit leverages GitHub.dev functionality and enables unauthorized access to both public and private repositories with read and write permissions.