The brief

Wednesday, May 20, 2026

GitHub suffered a breach of 3,800 internal repositories via malicious VS Code extension; separately, CISA and contractor credentials exposed in public repos. Simultaneously, 600+ malicious npm packages targeted @antv ecosystem in Shai-Hulud supply chain attack.

12 stories · 3 podcasts · get this by email each weekday

Today's stories

Google introduces Antigravity 2.0, featuring an updated desktop app that lets users orchestrate multiple agents, alongside an Antigravity CLI tool and SDK (Ivan Mehta/TechCrunch)
In stunning display of stupid, secret CISA credentials found in public GitHub repo
Google’s AI future demands trust — and your personal data
From teen hacker to Iron Dome researcher, this founder raised $28M to fight AI phishing
FBI seeks US-wide access to license plate cameras, wants "data in near real time"
Contractor’s public GitHub account exposed GovCloud and CISA credentials
Threat actors published 600+ malicious versions to npm as part of the Shai-Hulud supply chain campaign; most of the affected packages are in the @antv ecosystem (Bill Toulas/BleepingComputer)
GitHub is investigating unauthorized access to their internal repositories
GitHub says it's investigating "unauthorized access" to its internal repositories, and there's no proof of customer data outside its repositories being impacted (@github)
GitHub Compromised
Sources: an attack exploiting a previously unknown vulnerability in Huawei router software caused a three-hour nationwide telecoms outage in Luxembourg in 2025 (Alexander Martin/The Record)
GitHub confirms breach of ~3,800 internal repositories after one of its employees installed a malicious VS Code extension; TeamPCP claimed responsibility (Sergiu Gatlan/BleepingComputer)

Worth a listen

Marc Andreessen on AI, California, and the Future of America | Joe Rogan
Eviltokens: A Conversation with Huntress on an AI‑Enabled Device Code Phishing Campaign
Risky Business #838 -- GitHub investigates possible breach

← All editions