The Megalodon Breach: How TeamPCP Hijacked 5,500+ GitHub Repositories
Prevent the Megalodon supply chain attack. Learn how threat actors injected 5,718 malicious GitHub Actions workflows to steal OIDC tokens and cloud credentials.
8 min read
Topic
OIDC Token Theft
Every article tagged OIDC Token Theft, newest first.
2 articles
Related topics
- CI/CD Security, 1 article
- DevSecOps, 1 article
- GitHub Actions, 1 article
- GitHub Actions compromise, 1 article
- malicious GitHub commits, 1 article
- Megalodon supply chain attack, 1 article
- Mini Shai-Hulud, 1 article
- Supply Chain Attack, 1 article
- TanStack, 1 article
- TeamPCP, 1 article
- TeamPCP GitHub attack, 1 article
Articles tagged OIDC Token Theft
The Silent Worm: TeamPCP Hijacks TanStack in "Mini Shai-Hulud" Attack
TeamPCP's supply chain attack infected 170+ npm and PyPI packages like TanStack. Learn how the Mini Shai-Hulud worm bypasses SLSA and how to stop its wiper.
8 min readLooking for something specific?
Search every article by topic, tool or CVE.
Keep reading
Latest from the blog
sshole (CVE-2026-123158): OpenSSH Alpine Linux Password Bypass
OpenSSH 10.6p2 patches sshole (CVE-2026-123158, CVSS 8.1), a password bypass on Alpine Linux and musl systems without PAM. Check affected branches and fixes.
15 min read
GitHub Package Firewall: Install-Time Security for AI Agents and Pipelines
GitHub Package Firewall brings install-time npm policy gates, SLSA attestation checks, and version cooldowns to AI coding agents and CI/CD runners.
18 min read
Node.js Brotli RCE (CVE-2026-111497): Patch Guide
Node.js CVE-2026-111497 exposes Brotli decoding to potential RCE. Check affected versions, fetch() exposure, WAF limits, and the October 2026 patch checklist.
15 min read