github Archives - Recon Bee

GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

27Jul

By RBNo Comments

News

GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

GitHub has revealed a new cooldown feature in Dependabot that permits the tool to postpone opening a pull request for at least three days following the publication of a release. However, the behavior is still controlled by the cooldown configuration option in the dependabot.yml, so you can select a different cooldown parameter that works for your project, according to the Microsoft-owned company. GitHub claims that only version updates—which are intended to keep software dependencies current—are subject to the three-day cooldown setting. Security updates will keep being delivered immediately, enabling Dependabot to send out an alert and initiate a pull request to update the project to the updated version. The goal of this upgrade is to address situations in which a threat actor s...

GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier

23Jul

By RBNo Comments

News

GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier

GitHub will reduce public bug bounty payouts by at least half at every severity level starting on July 27, 2026. While its permanent invite-only VIP category will pay $30,000 or more, critical findings will go from $20,000 to $30,000+ to a constant $10,000. The prior compensation terms will be applied to reports submitted prior to that date, including those that are now in GitHub's expanding triage queue. According to GitHub, the modifications are meant to decrease noise while providing more prizes, quicker responses, and easier access to its security engineering team for seasoned researchers. According to the company, submitting more does not increase your earnings. "You are paid more when you submit more effectively. Fixed payments are replacing flexible ranges in the public pr...

The ‘Miasma’ worm source code briefly leaked on GitHub

11Jun

By RBNo Comments

News

The ‘Miasma’ worm source code briefly leaked on GitHub

For a limited period, the Miasma credential-stealing attack architecture was made available on GitHub. Recently, supply-chain hacks have been used to target open-source ecosystems. With many of the same characteristics, methods, and even code as the earlier Shai-Hulud worm that was previously posted on GitHub, Miasma seems to be a development of that worm. After infecting a developer's computer, the virus utilizes the build environment and cloud credentials to compromise trustworthy repositories and packages. Trojanized versions are then published to infect developers further down the chain. This autonomous, worm-like self-propagation mechanism has the ability to spread swiftly, possibly transforming a single breach into a massive supply chain assault. High-profile attacks aga...

NFCShare Android malware spreads via fake banking app updates on GitHub

9Jun

By RBNo Comments

News

NFCShare Android malware spreads via fake banking app updates on GitHub

Fake updates for trustworthy banking apps posted on GitHub are being used to spread new versions of the NFCShare Android virus. The infection has developed into a phishing campaign that targets clients of several banks and financial institutions around Europe in an attempt to obtain credit card information. NFCShare uses Android's IsoDep interface and EMV commands to read the data after deceiving victims with a phony verification page to place the cards close to the mobile device's near-field communication (NFC) chip. Under the guise of a security precaution, the malware obtains the victim's card number, type, expiration date, and four-digit PIN. It then uses a WebSocket channel to exfiltrate the information to the attacker's command-and-control (C2) host read more about NFCShare...

Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

29May

By RBNo Comments

News

Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

Microsoft has made a strong case for Coordinated Vulnerability Disclosure (CVD), calling on researchers to share their findings and provide impacted businesses with a chance to better understand the implications and take corrective action before they are made public. This comes after a researcher by the name of Chaotic Eclipse (also known as Nightmare-Eclipse) revealed information about several zero-day vulnerabilities that have affected several Windows components over the past month, including Defender and BitLocker. The researcher claimed that Microsoft's handling of the vulnerability disclosure process had broken down. Numerous zero-day vulnerabilities have been made public in recent weeks, according to the tech giant. "The disclosures put our users at needless risk, and Microsof...

Malicious npm Package Stole Files From Claude AI User Directory via GitHub

28May

By RBNo Comments

News

Malicious npm Package Stole Files From Claude AI User Directory via GitHub

A new malicious package with information-stealing capabilities has been found by cybersecurity experts on the npm repository. The "mouse5212-super-formatter" program, according to OX Security, is intended to upload files from ".mnt/user-data," a specific directory that Anthropic's Claude artificial intelligence (AI) tool uses to manage uploads and outputs in the background. Malware-Slop is the code name for the action. According to researchers Moshe Siman Tov Bustan and Nir Zadok, the malware's analysis reveals that the script poses as an internal "archive deployment sync" utility that verifies or initializes a GitHub repository, takes a quick "network status" snapshot, and then synchronizes local workspace files in an organized manner into a remote tracking tree. In actuality, t...

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension

21May

By RBNo Comments

News

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension

GitHub formally acknowledged on Wednesday that a staff device hack via a tainted version of the Nx Console Microsoft Visual Studio Code (VS Code) extension was the cause of the intrusion of its internal repositories. The announcement coincides with the Nx team's disclosure that the extension, nrwl.angular-console, was compromised following a recent TanStack supply chain attack on one of its developers' PCs. OpenAI, Mistral AI, and Grafana Labs are further businesses that were affected by the TanStack hack. According to a statement from GitHub's Chief Information Security Officer, Alexis Wales, "we have no evidence of impact to customer information stored outside of GitHub's internal repositories, such as our customers' own enterprises, organizations, and repositories." Customer d...

DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea

7Apr

By RBNo Comments

News

DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea

GitHub has been seen to be used as command-and-control (C2) infrastructure by threat actors most likely connected to the Democratic People's Republic of Korea (DPRK) in multi-stage operations against South Korean companies. According to Fortinet FortiGuard Labs, the attack chain consists of obfuscated Windows shortcut (LNK) files that serve as the beginning point for dropping a PowerShell script that prepares the assault's subsequent phase and a decoy PDF document. It has been determined that phishing emails are used to disseminate these LNK files. The malicious PowerShell script runs quietly in the background while the victim is shown the PDF document as soon as the payloads are downloaded. The PowerShell script scans for active processes associated with virtual machines, debuggers...

GitHub adds AI-powered bug detection to expand security coverage

26Mar

By RBNo Comments

News

GitHub adds AI-powered bug detection to expand security coverage

In order to find vulnerabilities in more languages and frameworks than only CodeQL static analysis, GitHub is implementing AI-based scanning for its Code Security tool. According to the developer collaboration platform, the action is intended to find security flaws in areas that are challenging to support using only standard static analysis. While AI detections will offer more comprehensive coverage for Shell/Bash, Dockerfiles, Terraform, PHP, and other ecosystems, CodeQL will continue to offer deep semantic analysis for supported languages. Early Q2 2026 is when the new hybrid model is anticipated to go into public preview, potentially as early as next month. A collection of application security technologies called GitHub Code Security is included right into GitHub workflows and...

13-Year-Old Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely

7Oct

By RBNo Comments

News

13-Year-Old Redis Flaw Exposed: CVSS 10.0 Vulnerability Lets Attackers Run Code Remotely

Redis has revealed information about a maximum-severity security vulnerability in its in-memory database software that, in some cases, might lead to remote code execution. The vulnerability, known as RediShell and tagged as CVE-2025-49844, has a CVSS score of 10.0. A GitHub alert for the vulnerability states that a specially designed Lua script might be used by an authenticated user to control the garbage collector, cause a use-after-free, and possibly result in remote code execution. The issue is present in all Redis versions that use Lua scripting. However, in order for exploitation to succeed, an attacker must first obtain authenticated access to a Redis instance. For this reason, it is essential that users secure their Redis instances with robust authentication and avoid leav...