#gitguardian

2 articles

GhostAction reached 30,000 repositories in two days. The only wave anyone has measured gave up 26 secrets

2026-10-15Security

GitGuardian's update records about 1,900 compromised GitHub accounts and more than 30,000 repositories targeted on 8 and 9 October. The number missing from every headline is how many secrets the campaign actually took, and the one wave with a published answer makes the gap look enormous.

Shai-Hulud searches 469 places now, and the new ones include your AI tool config

2026-09-09Security

GitGuardian found a variant of the npm worm checking 469 locations across developer environments for credentials, up from 189. That number counts places it looks, not credentials it found — and what was added is the interesting part: CI/CD tooling, cloud configuration, and AI tool settings.