The Hacker News(@TheHackersNews):Update: @SocketSecurity's threat intel team noted a possible link between this GitHub Actions attack and the recent AntV npm compromise. Both share the same exfil domain (t.m-kosche[.]com) and appear tied to the Mini Shai-Hulud activity cluster. Reminder: Every tag now points to malicious code. Quick action: Pin workflows to full commit SHA only. Check yours ASAP.

The Hacker News

@TheHackersNews

The #1# trusted source for cybersecurity news, insights, and analysis — built for defenders and trusted by decision-makers.

Joined October 2010

2K Following 2.5M Followers

The Hacker News@TheHackersNews

2026.05.19 07:29

Update: @SocketSecurity's threat intel team noted a possible link between this GitHub Actions attack and the recent AntV npm compromise. Both share the same exfil domain (t.m-kosche[.]com) and appear tied to the Mini Shai-Hulud activity cluster. Reminder: Every tag now points to malicious code. Quick action: Pin workflows to full commit SHA only. Check yours ASAP.