GhostAction Attack Targets 30,000+ GitHub Repositories
Date Observed: October 8-16, 2026 (latest two waves; campaign remains active)Ecosystem: GitHub, GitHub Actions, and developer workstationsTargets: Open-source maintainers; CI/CD secrets; cloud, package-publishing, and AI API credentialsAttack Type: Compromised maintainer accounts, malicious GitHub Actions workflow injection, credential theft, and developer-workstation persistenceImpact: More than 30,000 repositories targeted; about 1,900 GitHub user accounts compromised; 3,174 CI secrets […]
What is Software Supply Chain Security?
Software supply chain security is the practice of protecting every component, tool, and process that goes into building and shipping software, from open-source packages and third-party libraries to the build systems that assemble them into a finished product. Modern applications are assembled far more than they’re written from scratch, and each borrowed piece carries the […]
Dependency Confusion Attacks: How They Work and How to Stop Them at Build Time
Your software build imports external packages based on the name of the package. When your package manager sees a dependency called internal-auth-utils, it searches the configured package sources for a package with the dependency name. Dependency confusion leverages that process to perform package substitution. An attacker doesn’t need to breach your network or steal a […]
Malicious Post-Install Scripts: npm and PyPI Attacks Explained
Installing a package isn’t a passive download. Both npm and PyPI can run code on your machine the moment a package lands even before your application imports it. That behavior is a deliberate, ubiquitous feature, and that’s exactly what makes it such an effective attack surface. Nearly a third of PyPI packages trigger code execution […]
What are Secrets Leaks in CI/CD Pipelines?
Almost every modern application is assembled by an automated pipeline, and that pipeline can’t do its job without credentials. The credentials might include a key to pull a private dependency, a token to push an image, and a password to run a migration. Credentials are leaked far more often than most teams realize. In 2024 […]
Slopsquatting: How AI-Hallucinated Packages Threaten the Software Supply Chain
Slopsquatting is a software supply chain attack where criminals register malicious packages under the fake names that AI coding assistants invent, then wait for developers to install them. Because AI tools routinely recommend libraries that do not exist, attackers can turn a confident chatbot suggestion into a direct path into your build. The risk grows […]
InvisRisk Expands Build Application Firewall with Real-Time CI/CD Enforcement Across AWS and GitLab
New release extends runtime policy enforcement, stopping software supply chain threats during build execution before release. Houston, TX – June 2026 – InvisiRisk today announced a major step forward in securing modern software delivery pipelines, advancing its Build Application Firewall (BAF) to deliver real-time enforcement during CI/CD execution — an approach that addresses a critical […]
Open Source Vulnerability Management at Build Time
Open source vulnerability management at build time means inspecting and enforcing policy on every open source package the moment it enters your CI/CD pipeline, rather than scanning code only before or after a build runs. Open source makes up the majority of most modern codebases, and the riskiest moment comes when those dependencies get pulled […]
The Complete Application Security Stack Guide For 2026
A modern application security stack rests on four foundational categories (code security or SAST, dependency security or SCA, runtime security or DAST/RASP, and infrastructure security) plus a fifth layer that most organizations are missing: build-time security, also known as a Build Application Firewall (BAF). Each layer covers a different attack surface, and no single tool […]
What Is a Build Application Firewall?
TL;DR A Build Application Firewall (BAF) does for CI/CD pipelines what a WAF does for web applications: it sits inline, inspects live traffic, and enforces policy in real time. WAFs became mainstream because traditional network firewalls could not see application-layer attacks. BAFs address the same kind of visibility and enforcement gap in CI/CD, where pipelines […]