Free code on GitHub claims to break Firefox and Docker
A stranger is handing out code that they say can break into everyday software, and anyone can download it for free.
Fake LinkedIn recruiters hide a backdoor that fires on npm install
A recruiter messages a software developer on LinkedIn about a lead-engineer job. She sends a GitHub project and asks him to look at a bug.
10,000 cloned GitHub repos slip trojans past VirusTotal link checks
Search GitHub for a coding tool, pick a project that looks completely real, download its zip file, and you quietly get a trojan instead.
Your leaked API keys are this month's favorite hacker loot
Your old API keys are worth money to a stranger. That's the ugly lesson from this month, when attackers kept breaking into companies not by cracking passwords, but by finding login keys that careless coders left sitting in their own code.