GitHub
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Activity reported by Cyber Security NewsDeceptiveDevelopment hackers steal developer credentials to poison GitHub repositories and software packages
Recent news
DeepSeek releases research prototype of dsh-superagent, a coding agent that acts on team chat requests
DeepSeek has open-sourced dsh-superagent, a research prototype coding agent that performs work on a GitHub repository. It acts when an allowed user makes a request or a team-defined rule applies, and teams can open chat or GitHub scopes so that anyone in them can trigger work by mentioning the agent.
DeceptiveDevelopment hackers steal developer credentials to poison GitHub repositories and software packages
ESET reports that DeceptiveDevelopment, a North Korea-aligned group, used stolen Git credentials, SSH keys and tokens between April and September 2026 to alter public and private repositories, often rewriting commit history. Poisoned code appeared on npm, the Go module mirror, Packagist, PyPI and browser extension marketplaces, and the group deployed the OmniStealer infostealer and the DEVPOPPER remote access trojan.