Source: stepsecurity.io
StepSecurity introduces a tool called 'Malicious Files' designed to detect files planted by supply chain attacks in GitHub repositories and on developer machines. The article highlights two specific attack campaigns: Miasma and Shai-Hulud, which are known to leave behind malicious artifacts. The tool aims to help security teams identify and remediate these hidden threats. Supply chain attacks targeting developer environments and CI/CD pipelines represent a growing risk. By scanning repositories and local machines, the tool provides visibility into compromise indicators left by these attacks. This is part of StepSecurity's broader effort to secure software supply chains.
