dependabot - Security World Trend Now

Supply Chain Attackers Take Advantage of Dependabot on GitHub

Nguyen Michael2 years ago07 mins

Malicious Code Updates Target GitHub Repositories in Software Supply Chain Attack Overview In a recent attack on software supply chains, threat actors exploited stolen passcodes to inject malicious code updates into hundreds of GitHub repositories. The attackers used stolen personal access tokens (PATs) to commit code changes, leveraging the name of a popular tool called…

Securing Code Repositories: Preventing Fake Dependabot Commits and Stolen GitHub Credentials

Patel Maya2 years ago08 mins

Stolen GitHub Credentials Used to Push Fake Dependabot Commits Introduction Threat actors have been using stolen GitHub personal access tokens to push fake Dependabot contributions to hundreds of GitHub repositories, according to a report by application security firm Checkmarx. The attackers used the stolen access tokens to gain access to the repositories and inject malicious…