Susiloharjo

Nx Console VS Code extension (2.2M installs) compromised to steal 1Password, npm, GitHub, and AWS secrets via Sigstore-signed malicious packages.

GitHub Actions Supply Chain Attack Steals CI/CD Secrets In yet another escalation of software supply chain attacks, threat actors have compromised one of the most widely used GitHub Actions workflows — actions-cool/issues-helper — turning its entire release tag history into a delivery mechanism for credential-stealing malware. The attack, disclosed by StepSecurity on May 19, 2026, … Read more

CISA Contractor Leaked AWS GovCloud Keys on GitHub The Worst Leak I’ve Witnessed Sometimes the most damaging cybersecurity failures come not from sophisticated nation-state adversaries but from the mundane mistakes of trusted insiders. That lesson was driven home again this past weekend when security researchers discovered that a contractor for the U.S. Cybersecurity and Infrastructure … Read more