#github
-
Hugging Face crypto-mining campaign returns days after takedown
Attackers are publishing fake models on Hugging Face that hijack GPU servers for mining and plant backdoors, with the most popular one downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is set up to fool AI coding agents.
-
GitHub Launches npm Firewall to Stop Malicious Packages Before Installation
GitHub has opened a public preview of a package firewall for npm. It checks dependencies against a set of policies and blocks suspicious packages at install time.
-
Roku Moves Developer Repositories from GitHub to GitLab
Roku has announced on its developer blog that it is moving its code repositories from GitHub to GitLab.
-
Hijacked account: five OVHcloud CLI releases swapped for secret-stealing malware
An attacker used a hijacked contributor account to replace the archives in five releases of OVHcloud's command-line tool. The malicious build stole secrets from disk and was live on GitHub for just 94 minutes.
-
OpenAI drops another batch of mathematical breakthroughs
The company has published 722 manuscripts containing solutions to long-standing open problems, produced by an unreleased frontier model — and once again rattled the mathematical community.
-
GitHub Actions wobbled for nearly four hours
On the evening of 5 October, GitHub spent almost four hours fighting an Actions outage: workflows started late, and Pages along with billing pages went down too.
-
A GitHub 'Torture Chamber' for LLMs Ignites AI's Most Absurd Debate Yet
Someone built a 'torture chamber' for local language models and streams their 'suffering' online. The project has set off a fierce fight over 'model welfare'.
-
Compromised GitHub Actions brought back online with malware still attached
Two third-party GitHub Actions infected in May's Mini Shai-Hulud campaign were re-enabled and kept serving the old malicious payload for more than a week.
-
CrowdSec confirms source code leak from private repositories
CrowdSec has disclosed that part of its source code was leaked in May 2026. By its own assessment, customer data was not affected, and the likely point of entry was a compromised TanStack library.
-
Appeals Court Rejects Attempt to Expand Copyright in AI and GitHub Case
The U.S. Court of Appeals for the Ninth Circuit has rejected a reading of a DMCA provision that threatened to turn a narrow rule about removing authorship information into a new source of copyright infringement liability.
-
The Neural Network That Decides Whether a Number Is Numberwang
Developer GraafHenk has posted a tiny neural network on GitHub that delivers a verdict for Numberwang, a fictional game from a British sketch show. The whole project is a 1.8 MB model file and about a hundred lines of pure Python.
-
25 Minutes to Admin Access: How an AI Agent Found a Live Baseten GitHub Token
Strix was vetting the inference provider Baseten before entrusting it with the company's data — and its autonomous agent obtained a token with admin rights to key repositories in 25 minutes.
-
A Nix binary cache is just three functions — which means anything can be one
Farid Zakaria shows that to play the part of a Nix binary cache, all you need to do is answer three HTTP requests — and he proves it by turning GitHub Pages, npm, and even DNS into substituters.
-
Intel Has a Change of Heart: One Mono Font Spared After a Two-Day “Execution”
Amid cost cutting, Intel has spent two years shuttering its open-source projects. The One Mono font was set to be the next casualty, but a couple of days after it was archived the decision was reversed.
-
Nitter Returns: The Project Survives X Corp's Shutdown Demand
After legal threats from X Corp, Nitter's developers have announced that the project will continue. The news comes from an updated README on GitHub.
-
Claude Code Adds a Session Link to Commits — Users Want It Off by Default
A request has been filed in the Claude Code tracker asking to make the insertion of a session URL into commit messages and PR descriptions optional. Right now the feature is on by default, and people only find out about it after the fact.
-
Stop Flooding Open Source with AI Garbage for a Line on Your Résumé
A maintainer of open source projects writes that over the past year the nature of third-party contributions has changed dramatically: developers are using AI to fake useful activity on GitHub.
-
Two TeamPCP Suspects Arrested in Australia
The Australian Federal Police has arrested two young men from Western Australia believed to be members of TeamPCP — the group behind the longest-running string of software supply-chain attacks. The collective's leader was undone by his own carelessness.
-
GitHub blames its seven-hour August 17 outage on overloaded infrastructure
GitHub's CTO explained that the second major outage in August was caused not by a code bug but by a capacity shortfall: the service failed to scale in time for record traffic.
-
Cursor Launches Origin — Code Hosting to Spite GitHub Amid Outages
Cursor, the startup known for its AI code editor and recently folded into SpaceX, has unveiled Origin, a platform for hosting repositories — a direct alternative to GitHub. The launch coincided with yet another hours-long outage of the Microsoft service.
- More