Two actions-cool GitHub Actions hijacked on May 18 came back online on September 16, still serving the Mini Shai-Hulud stealer to tag-pinned workflows. Only workflows pinned to a pre-May 18 commit SHA escaped; the rest have CI secrets to rotate.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 47%
- Investor
- Investor 10%
Reality
- Evidence60
- Adoption40
- Hype gap+15
- Incentives30
- Confidence65
buildOne report1 publisher Tag-pinned workflows re-ran Mini Shai-Hulud after issues-helper was re-enabled
Socket says workflows using issues-helper@v2.2.1 re-ran Mini Shai-Hulud after the Action was re-enabled on September 16 with its malicious tags intact. The earlier takedown only made those jobs fail, so the fix that holds is dropping the Action or pinning a verified commit SHA.
Reality
- Evidence55
- Adoption35
- Hype gap+10
- Incentives
- Not scored
- Confidence55
buildConfirmed2 publishers September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence58
Google's undercover analyst watched TeamPCP poison packages from inside its core chat
Austin Larsen of Google's threat intelligence group says a Mandiant persona sat in TeamPCP's inner circle from almost the start of the campaign. For the companies the group breached, that infiltration was the warning system.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence55
An ex-employee's live OAuth token let strangers copy 170 CrowdSec repositories in nine minutes
TeamPCP's npm compromise of TanStack reached CrowdSec through a departed employee's laptop, and the company learned its private repositories had been copied only when the code surfaced on a dark web forum in September.
Reality
- Evidence58
- Adoption55
- Hype gap+12
- Incentives72
- Confidence60
Prismor checks every AI coding agent tool call against policy before it runs
The open-source layer from PrismorSec sits between Claude Code, Codex or Cursor and the shell, returning allow, warn or block on each call. Its own scoring puts the everyday preset at 31 percent coverage.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence40
buildOne report1 publisher The Mini Shai-Hulud worm passed provenance checks by running inside the release pipeline
Akamai says the May 11-12 wave poisoned a CI cache and minted publish credentials from inside a trusted build, so the attestation it produced was honest. Any gate that only checks for provenance would have passed it.
Reality
- Evidence38
- Adoption33
- Hype gap+9
- Incentives74
- Confidence44
buildOne report1 publisher A comment-triggered Actions workflow published ten malicious npm versions with valid provenance
Socket says all ten bad tarballs of @7nohe/openapi-react-query-codegen carry genuine GitHub Actions attestations, which is what you get when the attestation covers where a build ran rather than who wrote the commit it built.
Reality
- Evidence66
- Adoption58
- Hype gap+10
- Incentives72
- Confidence57