mastodon 4.8.0-alpha.3+glitchThings are not always what they seem
Redfin | Rent Head of Information Security
Former Ubisoft Director of Security Operations
Microsoft Alumni | Former Director of MSRC's Cloud Incident Response | He/Him/Hrm | Philosopher & Ninja
SANS:
GCIH #16353 - Cerified Incident Handler
GWAPT #3274- Web Application Pen Tester
GXPN #164 - Exploit Researcher and Advanced Penetration Tester
Previous internet worms, you could patch to protect yourself; these new worms aren't stopped by patching, there's a fundamental change needed to your development lifecycle thats needed, and you should be working on it right_now.
A great write up by StepSecurity to give a recap of the last few days this week.
Very prudent slides from Blue Hat 2026 a few weeks ago.
"A compromised dev workstation is NOT a user endpoint compromise -- it is potentially a compromise of every service the workstations tokens can reach.
You may have heard that Github had an incident recently involving the TeamPCP Supply Chain Worm, in this case a poisoned Visual Studio Code Extension. I cannot stress this enough, this is not a 'GitHub only' risk, these worms propagate by stealing personal access tokens, ssh keys, api keys, and other forms of credentials to infect other downstream users/consumers.
Did you or your company also install/update the same Visual Studio Code Extension that GitHub did?
These worms are spreading fast, May 11th, we saw announcements from StepSecurity that 174 packages were compromised. On May 19th, another round added an additional 323 packages as compromised.
If you have not already:
* You should be taking actions to block auto-updates of packages with Cooldown timers to prevent a package refresh that pulls in a poisoned package. https://cooldowns.dev/
* You should be implementing governance controls over Visual Studio Code to inventory and allow/deny list extensions: https://code.visualstudio.com/docs/enterprise/policies
* Lastly, should be checking your incident response processes to be able to quickly respond quickly to revocation of Personal Access Tokens (PATs) and other dev credentials. https://github.blog/changelog/2025-04-29-credential-revocation-api-to-revoke-exposed-pats-is-now-generally-available/
Yaaa, you will want Incident Reports to be certified organic...
Templates and style-guides are highly recommended though
Well, this post aged well...
If you are a GitHub Enterprise Server customer, you will need to take action. GitHub announced that one of the keys compromised by the threat actor breach was a signing key.
https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/
If you're keeping score, it's been a very big week
https://cybersecuritynews.com/megalodon-malware-github-repos/
