GitHub has recently expanded its secrets scanning capabilities to repositories containing PyPI and RubyGems registry secrets. The move helps protect millions of applications built by Ruby and Python ...

Malicious Lightning 2.6.2/2.6.3 released April 30 enable credential theft via hidden payload, leading to PyPI quarantine and ...

A malicious version of the PyTorch Lightning package published on the Python Package Index (PyPI) delivers a ...

The open source software development service has made it easier for developers using its public repositories to keep coding secrets and tokens close to the chest. Image: prima91/Adobe Stock ...

GitHub has disclosed a critical remote code execution flaw, CVE-2026-3854, exploitable via a single git push, and a popular PyPI package tied to GitHub Actions was hacked to deliver malware. Both ...

This was not a case of stolen credentials, but rather of vulnerability exploitation.

GitHub has announced that its enterprise-focused secret scanning tool for private repositories is now generally available. The Microsoft-owned code-hosting platform first debuted secret scanning for ...

GitGuardian has disclosed a new software supply chain attack campaign, dubbed GhostAction, that exfiltrated thousands of sensitive credentials before being detected and contained on September 5. The ...