UNPRECEDENTED GITHUB HACKING SPREE: “SECURITY RESEARCH” AI BOT COMPROMISES MAJOR REPOS

Summary from the TLDR InfoSec newsletter

Researchers from StepSecurity have uncovered an automated hacking bot, dubbed “hackerbot-claw,” which claims to have scanned over 47k repositories for security vulnerabilities but has actually exploited vulnerabilities to compromise 6 popular open-source projects. The compromised projects include repositories from DataDog, Microsoft, and Aqua Security. Aqua Security renamed and made Trivy private after the bot fully compromised it.