stepsecurity.io

Every one of the 25 is a mark on the map. Named now: 1 to 25, newest first.

1. JFrog exposes fake interview campaign targeting developer machinesstepsecurity.io15 h ago
2. AI pentesting tool ARTEX helps attackers exploit exposed secretsstepsecurity.io17 h ago
3. StepSecurity uncovers GitHub Actions secret stealing campaignstepsecurity.io12 Nov
4. StepSecurity pitches broader package protection than GitHub firewallstepsecurity.io11 Nov
5. Compromised Bee JS release targets Swarm wallets and devicesstepsecurity.io9 Nov
6. StepSecurity launches tools to find malicious files left by attacksstepsecurity.io3 Nov
7. Binance hack highlights risks to developer machines and signingstepsecurity.io30 Oct
8. Trojanised Claude Code Extension Installed Persistent SSH Backdoorstepsecurity.io30 Oct
9. StepSecurity contrasts Harden Runner with GitHub's egress firewallstepsecurity.io28 Oct
10. StepSecurity adds inventories to track AI agent pluginsstepsecurity.io27 Oct
11. Attackers Swapped OVHcloud CLI Binaries to Steal Credentialsstepsecurity.io24 Oct
12. Python Urges Users to Update Tools After CA Key Compromise Threatstepsecurity.io22 Oct
13. Backdoored LiteLLM release steals credentials and enables remote code executionstepsecurity.io21 Oct
14. OpenCode Reveals Ongoing Attack Affecting Linked AI Provider Usersstepsecurity.io18 Oct
15. GhostAction Campaign Hijacks Maintainers to Steal Secrets From 345 Repositoriesstepsecurity.io9 Oct
16. StepSecurity Maps AI Agent Skills to Expose Supply Chain Risksstepsecurity.io8 Oct
17. Poisoned npm Package Steals Developer Secrets and Threatens File Wipestepsecurity.io8 Oct
18. Malicious SubQuery npm Release Steals Credentials and Opens Remote Shellsstepsecurity.io5 Oct
19. Malicious npm Releases Turn AI Memory Plugin into Credential Trapstepsecurity.io23 Sep
20. Harden Runner shields GitHub Actions on AWS CodeBuildstepsecurity.io1 Sep
21. Harden Runner rolls out deny list egress for CI pipelinesstepsecurity.io1 Sep
22. Compromised npm package leaks GitHub credentials via harmful codestepsecurity.io28 Aug
23. Dev Machine Guard adds credential inventory to flag plaintext riskstepsecurity.io27 Aug
24. Dev Machine Guard launches browser extension inventory toolstepsecurity.io27 Aug
25. Typosquatted dependency hijacks Rust crate arrayrefstepsecurity.io20 Aug

names a CVE that is exploited in the wildnames a CVE

Zoom in on the map and the dots under the middle of it are named where they are.