Daily Writeups
@Daily_Writeups
3.45K subscribers
2 photos
127K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.45K subscribers
Daily Writeups
⤷ Title: Harden-Runner: EDR for CI/CD Stops Supply Chain Attacks Cold
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Sat, 05 Jul 2025 04:06:03 +0000
════════════════════════
⌗ Tags: #Open Source Tool #CI/CD #Continuous Delivery #Continuous Integration #cybersecurity #EDR #Endpoint Detection and Response #GitHub Actions #Harden_Runner #security #StepSecurity #supply chain attack
Penetration Testing Tools
Harden-Runner: EDR for CI/CD Stops Supply Chain Attacks Cold
StepSecurity's "Harden-Runner" is a CI/CD security agent functioning as an EDR for runners, preventing exfiltration, detecting tampering, and securing over a million workflow runs weekly.
36 views
Daily Writeups
⤷ Title: The Tag Trap: How a Single Commit Swap Turned Xygeni’s GitHub Action into a Clandestine Backdoor
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 12 Mar 2026 07:21:26 +0000
════════════════════════
⌗ Tags: #Malware #CI/CD Security #DevOps Security #GitHub Actions #GitHub Token Theft #malware #RCE #StepSecurity #supply chain attack #Tag Poisoning #Tech News 2026 #v5 tag #Xygeni
Penetration Testing Tools
The Tag Trap: How a Single Commit Swap Turned Xygeni’s GitHub Action into a Clandestine Backdoor
An imperceptible edit to a single tag transformed a ubiquitous security auditing instrument into a clandestine backdoor. A
❤1
10 views
Daily Writeups
⤷ Title: The Polymarket Trojan: Verified GitHub Org Hijacked to Distribute Crypto-Stealing Bots
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 19 Mar 2026 01:11:30 +0000
════════════════════════
⌗ Tags: #Malware #Crypto Stealer #cybersecurity #dev_protocol #GitHub Hijacking #infosec #npm malware #Polymarket #StepSecurity #supply chain attack #threat intelligence
Daily CyberSecurity
The Polymarket Trojan: Verified GitHub Org Hijacked to Distribute Crypto-Stealing Bots
StepSecurity uncovers a supply chain attack where a verified GitHub org, dev-protocol, was hijacked to spread malicious Polymarket bots and steal crypto.
23 views
Daily Writeups
⤷ Title: Malicious VeloraDEX SDK Compromises Developer Machines via npm
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 08 Apr 2026 01:58:56 +0000
════════════════════════
⌗ Tags: #Malware #@velora_dex/sdk #C2 #Credential Theft #cybersecurity #infosec #macOS Malware #Malware Analysis #Node.js #npm #StepSecurity #supply chain attack #zsh.profiler
Daily CyberSecurity
Malicious VeloraDEX SDK Compromises Developer Machines via npm
A malicious update to @velora-dex/sdk (v9.4.1) drops a stealthy macOS backdoor on import. Learn how to detect the zsh.profiler infection and rotate secrets.
21 views
Daily Writeups
⤷ Title: Developer Alert: Poisoned Nx Console VS Code Extension Steals AWS, npm, and GitHub Tokens
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 07:37:38 +0000
════════════════════════
⌗ Tags: #Malware #Bun JavaScript Runtime #Dangling Orphan Commit #DNS Tunneling Exfiltration #GitHub Token Theft #Multi_Stage Credential Harvester #Nx Console Extension Compromise #rwl.angular_console #Sigstore Supply Chain Poisoning #StepSecurity Forensic Audit #Visual Studio Code Marketplace
Penetration Testing Tools
Developer Alert: Poisoned Nx Console VS Code Extension Steals AWS, npm, and GitHub Tokens
The highly popular Nx Console extension for Visual Studio Code has been compromised via a weaponized supply-chain injection.
10 views