Supply-chain compromise affecting an organization (Software Development)

Threat actors behind GhostAction expanded a supply chain attack by planting credential stealer malware disguised as a font file across 94 GitHub repositories. The attackers phish open-source developers and inject malicious GitHub Actions workflows into compromised projects.

Sources

• No primary source yet. This entry stays anonymized until one exists.
• Upstream: Security news (RSS + Claude). The upstream record names the organization, so it is not linked here.
• Candidate incidents extracted from public security reporting; every entry links its article