Newsroom

StepSecurity in the news: Media coverage and industry mentions

Featured News

Widespread Supply Chain Compromise Impacting npm Ecosystem

September 23, 2025

Self-Replicating Worm Hits 180+ Software Packages

September 16, 2025

Recent News

BleepingComputer

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

November 24, 2025

Dark Reading

Catching Up with Varun Sharma, CEO, StepSecurity and Ashish Kurmi, CTO, StepSecurity

September 19, 2025

The Hacker News

GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories

March 17, 2025

BleepingComputer

Supply chain attack on popular GitHub Action exposes CI/CD secrets

March 17, 2025

DevOps.com

GitHub Action Compromise Risks Data Leaks for 23,000 Repositories

March 17, 2025

CISA

Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)

March 26, 2025

GeekWire

Former Microsoft engineers raise $3M for cybersecurity startup StepSecurity

May 1, 2024

The Cyber Express

New Shai-Hulud Attack Hits Nearly 500 npm Packages with 100+ Million Downloads

November 24, 2025

CYBERSECURITY DIVE

Supply chain attack against GitHub Action triggers massive exposure of secrets

March 17, 2025

Security Boulevard

The Latest Shai-Hulud Malware is Faster and More Dangerous

November 25, 2025

The Register

GitHub supply chain attack spills secrets from 23,000 projects

March 17, 2025

ITPro.

Organizations urged to act fast after GitHub Action supply chain attack

March 17, 2025

SECURITYWEEK

Popular GitHub Action Targeted in Supply Chain Attack

March 17, 2025

IT BREW

GitHub supply-chain attack signals possibility of more code chaos

March 20, 2025

BANK INFO SECURITY

Supply Chain Attack Targets GitHub Repositories and Secrets

March 17, 2025

The Register

Nx NPM packages poisoned in AI-assisted supply chain attack

August 27, 2025

The Hacker News

Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

August 28, 2025

SECURITYWEEK

Hackers Target Popular Nx Build System in First AI-Weaponized Supply Chain Attack

August 28, 2025

KrebsonSecurity

Self-Replicating Worm Hits 180+ Software Packages

September 16, 2025

TrendMicro

What We Know About the NPM Supply Chain Attack

September 18, 2025

CISA

Widespread Supply Chain Compromise Impacting npm Ecosystem

September 23, 2025

CyberSecurityDive

CISA urges dependency checks following Shai-Hulud compromise

September 24, 2025

Center for Internet Security

A Vulnerability in Nx (build system) Package Could Allow for Sensitive Data Exfiltration

September 25, 2025

DevOps.com

Worms in the Supply Chain: Shai-Hulud and the Next DevOps Reckoning

October 1, 2025