A VS Code exploit for github.dev can steal GitHub OAuth tokens after one malicious link, exposing private repositories while teams await a patch.

Miasma hit 73 Microsoft repos across four GitHub orgs, forcing access disablement and exposing open-source trust risks.

GitHub confirmed attackers stole 3,800 internal repositories via a poisoned VS Code extension. The same threat group, TeamPCP, simultaneously compromised Microsoft's durabletask Python ...

VS Code agents are now in Stable preview, and the 1.122 update removed the GitHub OAuth requirement from BYOK, letting defense, healthcare, and finance developers run fully air-gapped AI-assisted ...

A single developer. One poisoned extension. Five supply chain surfaces compromised in 48 hours. And a threat group claiming their tool was built by Claude.On May 20, 2026, GitHub confirmed Opens a new ...

Compromised npm packages targeted Red Hat cloud services, enabling credential theft and expanding supply chain risks.

Automatic cleaners only know about a fixed set of cache folders, and the decisions they make are limited to what they were preprogrammed for. ApexDisk finds and surfaces everything else they skip: ...