Newsroom

StepSecurity in the news: Media coverage and industry mentions

Featured News

Hackers Compromise Axios, Widely Used Software Development Tool

March 31, 2026

North Korean hackers blamed for hijacking popular Axios open source project to spread malware

March 31, 2026

Recent News

Bloomberg

Hackers Compromise Axios, Widely Used Software Development Tool

March 31, 2026

Tech Crunch

North Korean hackers blamed for hijacking popular Axios open source project to spread malware

March 31, 2026

Dark Reading

Axios NPM Package Compromised in Precision Attack

April 1, 2026

The Hacker News

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

March 31, 2026

CyberScoop

Attack on axios software developer tool threatens widespread compromises

March 31, 2026

BleepingComputer

Hackers compromise Axios npm package to drop cross-platform malware

March 31, 2026

CSO

Attackers trojanize Axios HTTP library in highest-impact npm supply chain attack

March 31, 2026

SECURITYWEEK

Axios NPM Package Breached in North Korean Supply Chain Attack

April 1, 2026

The Register

Top npm package backdoored to drop dirty RAT on dev machines

March 31, 2026

Venture Beat

Hackers slipped a trojan into axios, the code library behind most of the internet

April 1, 2026

Gov Info Security

Backdooring of JavaScript Library Axios Tied to North Korea

April 10, 2026

Help Net Security

Axios npm packages backdoored in supply chain attack

March 31, 2026

Malwarebytes

Axios supply chain attack chops away at npm trust

March 31, 2026

NextGov

North Korea-linked hackers suspected in Axios open-source hijack, Google analysts say

March 31, 2026

Awesome Agents

An AI Agent Just Pwned Trivy's 32K-Star Repo via GitHub Actions

March 2, 2026

CyberNews

AI bot compromises five major GitHub repositories

March 3, 2026

CyberNews

Critical supply chain attack hits LiteLLM, exposing AI developers

March 25, 2026

Dark Reading

Xygeni GitHub Action Compromised Via Tag Poison

March 11, 2026

gbhackers

Hackerbot-Claw Bot Exploits GitHub Actions CI/CD Flaw to Attack Microsoft and DataDog

March 3, 2026

Hunter Strategy

Hackerbot-Claw GitHub Actions Exploitation Campaign

March 3, 2026

InfoQ

AI-Powered Bot Compromises GitHub Actions Workflows Across Microsoft, DataDog, and CNCF Projects

March 11, 2026

Phoenix Security

TeamPCP Supply Chain Attack: Trivy to Checkmarx to npm (2026)

March 24, 2026

Rock Cyber Musings

Agent Supply Chain Attacks: Your Scanner Already Switched Sides

April 7, 2026

The Hacker News

Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets

March 11, 2026

BleepingComputer

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

November 24, 2025

The Hacker News

GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories

March 17, 2025

BleepingComputer

Supply chain attack on popular GitHub Action exposes CI/CD secrets

March 17, 2025

DevOps.com

GitHub Action Compromise Risks Data Leaks for 23,000 Repositories

March 17, 2025

CISA

Supply Chain Compromise of Third-Party tj-actions/changed-files (CVE-2025-30066) and reviewdog/action-setup@v1 (CVE-2025-30154)

March 26, 2025

GeekWire

Former Microsoft engineers raise $3M for cybersecurity startup StepSecurity

May 1, 2024

The Cyber Express

New Shai-Hulud Attack Hits Nearly 500 npm Packages with 100+ Million Downloads

November 24, 2025

CYBERSECURITY DIVE

Supply chain attack against GitHub Action triggers massive exposure of secrets

March 17, 2025

Security Boulevard

The Latest Shai-Hulud Malware is Faster and More Dangerous

November 25, 2025

The Register

GitHub supply chain attack spills secrets from 23,000 projects

March 17, 2025

ITPro.

Organizations urged to act fast after GitHub Action supply chain attack

March 17, 2025

Dark Reading

Catching Up with Varun Sharma, CEO, StepSecurity and Ashish Kurmi, CTO, StepSecurity

September 19, 2025

SECURITYWEEK

Popular GitHub Action Targeted in Supply Chain Attack

March 17, 2025

IT BREW

GitHub supply-chain attack signals possibility of more code chaos

March 20, 2025

BANK INFO SECURITY

Supply Chain Attack Targets GitHub Repositories and Secrets

March 17, 2025

The Register

Nx NPM packages poisoned in AI-assisted supply chain attack

August 27, 2025

The Hacker News

Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

August 28, 2025

SECURITYWEEK

Hackers Target Popular Nx Build System in First AI-Weaponized Supply Chain Attack

August 28, 2025

KrebsonSecurity

Self-Replicating Worm Hits 180+ Software Packages

September 16, 2025

TrendMicro

What We Know About the NPM Supply Chain Attack

September 18, 2025

CISA

Widespread Supply Chain Compromise Impacting npm Ecosystem

September 23, 2025

CyberSecurityDive

CISA urges dependency checks following Shai-Hulud compromise

September 24, 2025

Center for Internet Security

A Vulnerability in Nx (build system) Package Could Allow for Sensitive Data Exfiltration

September 25, 2025

DevOps.com

Worms in the Supply Chain: Shai-Hulud and the Next DevOps Reckoning

October 1, 2025