GitHub Advanced Security
“Fix vulnerabilities and safeguard your software supply chain with built-in, AI-powered security.”
Dependency review, code scanning and secret scanning with push protection.
Product pageGitHub
United States1 product listed
Join the world's most widely adopted, AI-powered developer platform where millions of developers, businesses, and the largest open source community build software that advances humanity.
Our summaryCode hosting platform owned by Microsoft. GitHub Security Lab researches open-source vulnerabilities.
- Products listed
- 1
- Research stories
- 13
- Incidents and advisories
- 75
- Indicators
- 127
GitHub in our news, month by month
ResearchIncidents and advisories
1
27
May
5
11
Jun
4
11
Jul
3
Aug
1
5
Sept
5
Oct
Products and the controls they provide
External reviews
Independent tests, peer reviews and articles about GitHub. We link to them; we did not write or commission them, and nobody pays to appear here.
Research by GitHub
Stories in our coverage based on what researchers at GitHub found or reported: 13 in total.
- 16 Sept 2026GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
GitHub Actions adds cache-mode to mitigate cache poisoning risks.
- 27 Jul 2026New GitHub, PyPI Policies Boost Supply Chain Security
GitHub and PyPI implement new policies to enhance supply chain security.
- 27 Jul 2026GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub Dependabot adds a 3-day cooldown for version updates to prevent poisoned package adoption.
- 9 Jul 2026npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk
npm 12 disables install scripts by default to mitigate supply chain risks.
- 23 Jun 2026GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
GitHub updates actions/checkout to block pwn request attacks via pull_request_target.
- 20 Jun 2026GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts
GitHub Actions Checkout v7 now blocks risky pull_request_target checkouts by default.
- 13 Jun 2026NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks
NPM 12 will block script execution from dependencies by default to prevent supply chain attacks.
- 23 May 2026npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
npm adds 2FA-gated publishing and package install controls to combat supply chain attacks.
- 26 Mar 2026ThreatsDay Bulletin: PQC Push, AI Vuln Hunting, Pirated Traps, Phishing Kits & 20 More Stories
Weekly threat roundup covers PQC migration, AI vuln hunting, Sandworm backdoors, crypto wallet scams, and phishing kits.
- 24 Mar 2026💥 All 294,000+ unreviewed GitHub advisories are available now. Give it about 15 seconds or so to...
GitHub releases 294,000+ unreviewed security advisories as searchable dataset.
Incidents and advisories
Stories where a GitHub product had a vulnerability or was attacked, or GitHub itself was: 75 in total. Useful if you run its products.
- 15 Oct 2026GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction campaign compromises 1,900 GitHub accounts, targets 30,000+ repositories.
- 13 Oct 2026GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub expires npm trusted publishing configs after 48 hours to prevent package hijacking.
- 9 Oct 2026Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction campaign compromises GitHub accounts to inject malicious workflows into repositories.
- 9 Oct 2026New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
GhostAction campaign expands to steal cloud credentials from Git history and working tree.
- 6 Oct 2026Introducing Socket Scanning for VS Code Marketplace Extensions
Socket launches experimental scanning for VS Code Marketplace extensions to detect malicious code.
- 26 Sept 2026GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Compromised GitHub Actions re-enabled with active malware payload for over a week.
- 18 Sept 2026Happy Birthday, Shai-Hulud
Shai-Hulud npm worm anniversary highlights year of supply chain attacks and arrests.
- 18 Sept 2026Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents
Flaw in AI coding agents allows repo owners to swap pinned plugin code for malicious versions.
- 27 Aug 2026Australia arrests alleged TeamPCP hackers behind supply-chain attacks
Australia arrests two men linked to TeamPCP, a hacking group behind supply-chain attacks.
- 4 Aug 2026ChainDrop supply chain compromise: Anatomy of a self-propagating worm
Credential-stealing worm in 400+ npm packages self-propagates by republishing malicious updates.
Indicators from these storieslatest 30 of 127 · show· hide
Vendor Watch
Run GitHub?
Get an email when a reviewed story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
From GitHub
Is this your company, or did we get something wrong?
Tell us what to fix on this page: a product, a description, a link or a review. We check every suggestion before changing anything, and listing stays free and editorial.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.