Top all-time · #2394
Step Security Blog
Company blog · stepsecurity.io/blog · on HN as varunsharma07securityprogramming
Step Security Blog is the company blog at stepsecurity.io, writing about security and programming. Since 2023, 32 different Hacker News readers have linked it 54 times, most often “Hackerbot-Claw: AI Bot Exploiting GitHub Actions – Microsoft, Datadog Hit So Far”. It is still writing: the last post was on 2026-11-01, and you can follow it by feed.
Too few sampled comments (15) to say how often HN recommends it.?
Why HN links it
Linked for supply-chain attack write-ups on npm, GitHub Actions and VS Code extensions, covering incidents such as tj-actions/changed-files, Nx, Shai-Hulud and the Miasma worm.
Summarised by Claude from a sample of 15 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Detect, prevent, and respond to software supply chain attacks. End-to-end protection for AI agents, developer machines, open source packages, and CI/CD pipelines.
Most-linked posts?
- Hackerbot-Claw: AI Bot Exploiting GitHub Actions – Microsoft, Datadog Hit So Far4 people · 4 mentions · first linked 2026-03-01
- Miasma Worm Hits Microsoft Again3 people · 3 mentions · first linked 2026-06-08
- Popular Nx Build System NPM Package Compromised with Data Stealing Malware2 people · 3 mentions · first linked 2025-08-27
- NX compromised: supply chain attack via IDE extension, again2 people · 3 mentions · first linked 2026-05-18
- Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push2 people · 2 mentions · first linked 2026-03-14
- Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos2 people · 2 mentions · first linked 2025-03-14
- Trivy Compromised a Second Time – v0.69.4 binaries, setup-trivy, trivy-action2 people · 2 mentions · first linked 2026-03-20
- Ctrl/tinycolor and 40 NPM Packages Compromised2 people · 2 mentions · first linked 2025-09-16
- TeamPCP's Mini Shai-Hulud Is Back2 people · 2 mentions · first linked 2026-05-12
What Hacker News says?
> One thing I was thinking of was sort of a "delayed" mode to updating my own dependencies. You can do it: https://github.blog/changelog/2025-07-01-dependabot-supports... https://docs.renovatebot.com/configuration-options/#minimumr... https://www.stepsecurity.io/blog/introducing-the-npm-package...
Comment linking /blog/introducing-the-npm-package-cooldown-check
on “Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised”Submitted Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos as a story · 273 points
HN discussionThis is a much better writeup than semgrep’s: https://www.stepsecurity.io/blog/supply-chain-security-alert...
Comment linking /blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
on “Nx compromised: malware uses Claude code CLI to explore the filesystem”Submitted eslint-config-prettier npm package compromised as a story · 74 points
HN discussionClaude Code is an agent. It will not call any tools or commands without your prior consent. Edit: unless you pass it an override like --dangerously-skip-permissions, as this malware does. https://www.stepsecurity.io/blog/supply-chain-security-alert...
Comment linking /blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
on “Malicious versions of Nx and some supporting plugins were published”Submitted Num2words PyPI Package Compromised as a story · 22 points
HN discussion@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this: https://www.stepsecurity.io/blog/harden-runner-detection-tj-...
Comment linking /blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
on “Popular GitHub Action tj-actions/changed-files is compromised”Submitted Popular Nx Build System NPM Package Compromised with Data Stealing Malware as a story · 10 points
HN discussion> This is why I avoid using non-official actions where possible and always set a version for the action. Those are good practices. I would add that pinning the version (tag) is not enough, as we learnt with the tj-actions/changed-files event. We should pin the commit sha.[0]. Github states this in their official documentation [1] as well: > Pin actions to a full length commit SHA > Pin actions to a tag only if you t…
Comment linking /blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
on “Bypassing GitHub Actions policies in the dumbest way possible”Submitted Grafana GitHub Actions Security Incident as a story · 10 points
HN discussionNo, the reference to May 19 in the article is about a previous supply chain attack against AntV ( https://www.stepsecurity.io/blog/shai-hulud-here-we-go-again... ). I think there may be some copy-paste mistakes where they reused part of that previous article and didn't contextualize it correctly. The npm package `@redhat-cloud-services/chrome` version 2.3.1, which was part of this current supply chain attack, was pu…
Comment linking /blog/shai-hulud-here-we-go-again-mass-npm-supply-chain-attack-hits-the-antv-ecosystem
on “NPM packages from RedHat have been compromised”Submitted Hackerbot-Claw: AI Bot Exploiting GitHub Actions – Microsoft, Datadog Hit So Far as a story · 9 points
HN discussionShould link to the original announcement I think: https://www.stepsecurity.io/blog/multiple-redhat-cloud-servi...
Comment linking /blog/multiple-redhat-cloud-services-npm-packages-compromised
on “NPM packages from RedHat have been compromised”Submitted Cline Supply Chain Attack: Cline 2.3.0 Silently Installs OpenClaw as a story · 9 points
HN discussionThread on the post from main rust blog: https://news.ycombinator.com/item?id=49372853 Direct post link: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on... Initial report: https://github.com/rustsec/advisory-db/issues/3161 Other vendor posts: * https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-... * https://research.jfrog.com/post/arrayref-proc-macro1-crates-... * https://www.aikido.dev/blog/tw…
Comment linking /blog/arrayref-rust-crate-supply-chain-attack
on “Malicious Rust Crate Arrayref Runs a Build-Time Payload”Submitted Mini Shai-Hulud: Bun Payloads Hit SAP NPM Packages as a story · 7 points
HN discussionWe (StepSecurity) published a full analysis of both payload stages: https://www.stepsecurity.io/blog/chaindrop-npm-worm Some additional detail from our analysis: 1. Provenance did not fail, it worked as designed and still shipped malware. The initial 11 packages were published through npm OIDC Trusted Publishing with valid SLSA attestations. The attacker compromised the maintainer's GitHub account and let the projec…
Comment linking /blog/chaindrop-npm-worm
on “Keyv and friends compromised in active Shai-Hulud supply chain attack”Submitted Security Breach in Stripe Repo: A Deep Dive into the "Pwn Request" Vulnerability as a story · 7 points
HN discussionPlease, someone explain how it's possible to add obfuscated file to so many repositories? Do they don't have any code reviews? Also, the title is misleading, setup adds config to be auto executed by people who work on the repo. They would have to use vscode/cursor/claude/gemini. People who use codex / opencode / other harnesses are safe I guess. Details: https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-...
on “Microsoft's open source tools were hacked to steal passwords of AI developers”Submitted Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push as a story · 5 points
HN discussionhttps://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-... mentions that it plants `.claude/settings.json`, `.gemini/settings.json`, `.cursor/rules/setup.mdc`, and `.vscode/tasks.json` to execute its payload as a setup task. VSCode will be used by plenty of non-AI-using developers, and the credential harvester is not specific to AI API tokens, but that 3/4 of the targets are AI coding tools is I assume where th…
on “Microsoft's open source tools were hacked to steal passwords of AI developers”Submitted Malicious NPM Packages Found in React Native – 130K+ Monthly Downloads Hit as a story · 4 points
HN discussionThere are rumours that was NX Console VS code extension https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...
Comment linking /blog/nx-console-vs-code-extension-compromised
on “GitHub confirms breach of 3,800 repos via malicious VSCode extension”Submitted Miasma Worm Hits Microsoft Again as a story · 3 points
HN discussionPer security advisory on GitHub: Root Cause One of our developers was compromised by a recent supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh). This allowed the attacker to run workflows on our GitHub repository as a contributor. More links: https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://www.stepsecurity.io/blog/nx-console-vs-code-extensi…
Comment linking /blog/nx-console-vs-code-extension-compromised
on “Nx Console VS Code extension was the initial access vector in the GitHub breach”Submitted Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan as a story · 3 points
HN discussionshai-hulud and variants https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-s...
Comment linking /blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
on “'No Way to Prevent This,' Says Only Package Manager Where This Regularly Happens”Submitted Trivy Compromised a Second Time – v0.69.4 binaries, setup-trivy, trivy-action as a story · 3 points
HN discussionNot a drive-by PR, but once a package is compromised it often does spread to its reverse-dependencies via mechanisms like setup.py at build time . There was case like this with setup.py less than two months ago: https://www.stepsecurity.io/blog/forcememo-hundreds-of-githu... Lots of npm supply chain attacks propagate at build time via post-install hooks, too.
Comment linking /blog/forcememo-hundreds-of-github-python-repos-compromised-via-account-takeover-and-force-push
on “Incident CVE-2024-Yikes”Submitted Ctrl/tinycolor and 40 NPM Packages Compromised as a story · 3 points
HN discussion
