🤖robot.villas
PostsTagsStatsStatusAbout

© 2025 - 2026 Nat Welch. All rights reserved.

← All bots

StepSecurity Blog

@stepsecurity@robot.villas

StepSecurity's software supply-chain security research, threat analysis, CI/CD guidance, and updates to its developer and GitHub Actions security products.

Source: https://www.stepsecurity.io/blog/rss.xml

Homepage: https://www.stepsecurity.io/blog

Follow from your server

Enter the server your account is on. You'll finish following there.

or
Or search your app for@stepsecurity@robot.villas

Don't have an account? Find a server at joinmastodon.org

Posts
100
Followers
0
Following
1

Posts

  • @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence #Security #SupplyChain #Malware

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383501

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383501

    Don't have an account? Find a server at joinmastodon.org

    Apr 9, 2026

  • TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package #CyberSecurity #SupplyChain #Malware

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383588

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383588

    Don't have an account? Find a server at joinmastodon.org

    Apr 2, 2026

  • Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor #CyberSecurity #OpenSource #DevOps

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383580

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383580

    Don't have an account? Find a server at joinmastodon.org

    Apr 2, 2026

  • litellm: Credential Stealer Hidden in PyPI Wheel #Security #SupplyChain #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383600

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383600

    Don't have an account? Find a server at joinmastodon.org

    Mar 28, 2026

  • xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning #Security #SupplyChain #CICD

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383677

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383677

    Don't have an account? Find a server at joinmastodon.org

    Mar 26, 2026

  • ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push #CyberSecurity #DevSecOps #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383666

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383666

    Don't have an account? Find a server at joinmastodon.org

    Mar 26, 2026

  • Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys #CyberSecurity #OpenSource #DevOps

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383656

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383656

    Don't have an account? Find a server at joinmastodon.org

    Mar 26, 2026

  • Malicious npm Releases Found in Popular React Native Packages - 130K+ Monthly Downloads Compromised #Security #Software #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383645

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383645

    Don't have an account? Find a server at joinmastodon.org

    Mar 26, 2026

  • bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys #CyberSecurity #OpenSource #SupplyChain

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383637

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383637

    Don't have an account? Find a server at joinmastodon.org

    Mar 26, 2026

  • Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised #Security #SupplyChain #DevOps

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383626

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383626

    Don't have an account? Find a server at joinmastodon.org

    Mar 26, 2026

  • CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem #Security #SoftwareSupplyChain #npm

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383615

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383615

    Don't have an account? Find a server at joinmastodon.org

    Mar 26, 2026

  • Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags #Security #SupplyChain #GitHub

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383607

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383607

    Don't have an account? Find a server at joinmastodon.org

    Mar 26, 2026

  • kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package #CyberSecurity #Emacs #Kubernetes

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383686

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383686

    Don't have an account? Find a server at joinmastodon.org

    Mar 11, 2026

  • Harden Runner Now Supports Windows and macOS GitHub Actions Runners #DevSecOps #GitHubActions #Security

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383709

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383709

    Don't have an account? Find a server at joinmastodon.org

    Mar 1, 2026

  • How StepSecurity Caught a Release Storm in Microsoft's @types Packages #Security #SupplyChain #OpenSource

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383697

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383697

    Don't have an account? Find a server at joinmastodon.org

    Mar 1, 2026

  • Celebrating 1000 Repositories Secured with Harden Runner: A Journey of Growth and Collaboration #DevSecOps #OpenSource #Security

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383759

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383759

    Don't have an account? Find a server at joinmastodon.org

    Feb 15, 2026

  • How to Use Docker in Actions Runner Controller (ARC) Runners Securely #DevSecOps #CICD #Docker

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383750

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383750

    Don't have an account? Find a server at joinmastodon.org

    Feb 15, 2026

  • 2024 in Review: The Evolution of CI/CD Security & What's Next #DevSecOps #CICD #Security

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383741

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383741

    Don't have an account? Find a server at joinmastodon.org

    Feb 15, 2026

  • 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) #Security #OpenSource #SoftwareDevelopment

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383729

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383729

    Don't have an account? Find a server at joinmastodon.org

    Feb 15, 2026

  • 10,000 Open-Source Projects Now Secured by Harden-Runner Community-Tier: A Milestone Three Years in the Making #OpenSource #Security #DevOps

    Boost from your server

    Enter the server your account is on. The post opens there so you can boost it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383719

    Don't have an account? Find a server at joinmastodon.org

    Favorite from your server

    Enter the server your account is on. The post opens there so you can favorite it.

    or
    Or paste this post's address into your app's search:https://robot.villas/users/stepsecurity/posts/22383719

    Don't have an account? Find a server at joinmastodon.org

    Feb 15, 2026
« Newer