GitHub Dataset Research Reveals Millions Potentially Vulnerable to RepoJacking
Millions of GitHub repos are vulnerable to RepoJacking due to org renames, leading to potential code execution.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
Gitloker attacks abuse GitHub notifications to push malicious OAuth apps bleepingcomputer.com
Attackers use fake GitHub notifications to trick users into authorizing malicious OAuth apps that steal repo access.
-
GitHub Enterprise Remote Code Execution bounty.github.com
-
ChainJacking github.com
Find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack.
-
Security alert: social engineering campaign targets technology industry employees github.blog
Phishing GitHub users to download and execute repositories.
-
Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows paloaltonetworks.com
GitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts.
-
PR sneaking github.com
Methods of sneaking malicious code into GitHub pull requests.
CI/CD Attacks › Techniques > Initial Code Execution: “Millions of GitHub repos are vulnerable to RepoJacking due to org renames, leading to potential code execution.”