The Hacker News(@TheHackersNews):Update: @SocketSecurity's threat intel team noted a possible link between this GitHub Actions attack and the recent AntV npm compromise. Both share the same exfil domain (t.m-kosche[.]com) and appear tied to the Mini Shai-Hulud activity cluster. Reminder: Every tag now points to malicious code. Quick action: Pin workflows to full commit SHA only. Check yours ASAP.

The Hacker News

@TheHackersNews

The #1# trusted source for cybersecurity news, insights, and analysis — built for defenders and trusted by decision-makers.

가입 October 2010

2K 팔로잉 중 2.5M 팬

The Hacker News@TheHackersNews

2026.05.19 07:29

Update: @SocketSecurity's threat intel team noted a possible link between this GitHub Actions attack and the recent AntV npm compromise. Both share the same exfil domain (t.m-kosche[.]com) and appear tied to the Mini Shai-Hulud activity cluster. Reminder: Every tag now points to malicious code. Quick action: Pin workflows to full commit SHA only. Check yours ASAP.