SANDWORM_MODE: How a Shai-Hulud-Style npm Worm Targets CI/CD Pipelines
SANDWORM_MODE: A New Wave of npm Supply Chain Attacks Targeting CI/CD Pipelines Date of Discovery: February 20, 2026Ecosystem: npmType of Attack: Credential theft + AI tool compromise + worm propagationScope: At least 19 typo-squatted npm packagesImpact: Credential theft, GitHub Actions abuse, MCP injection, multi-channel exfiltration, and destructive fallback capability A coordinated supply chain attack targeted […]
Hackerbot-Claw: AI-Driven Pull Request Exploits in GitHub Actions CI/CD
Hackerbot-Claw: AI-Driven Pull Request Exploits in GitHub Actions CI/CD Date Observed: Late February 2026 Ecosystem: GitHub Actions CI/CD Attack Type: Pull-request triggered workflow exploitation → Remote Code Execution (RCE) → Token theft Key Takeaways: A recent campaign attributed to the GitHub account “Hackerbot-Claw” targeted open-source repositories by exploiting misconfigured GitHub Actions workflows. Public reporting indicates […]
Why Traditional DevOps Security Tools Miss CI/CD Pipeline Attacks
Why Traditional DevOps Security Tools Miss CI/CD Pipeline Attacks by Tom Hamilton, CTO and Co-Founder, InvisiRisk, Inc. Key Takeaways: The uncomfortable truth is that a CI/CD pipeline can look secure on paper and still leak secrets or produce compromised builds in practice. Scanners are excellent at finding known issues in source code, open-source dependencies, and […]