# Socket Weekly: New GhostAction Wave Sweeps Git History for Cloud… Canonical: https://brew.new/templates/socket/socket-weekly-new-ghostaction-wave-sweeps-git-history-for-cloud Brand: socket.dev Category: welcome ![Preview of Socket Weekly: New GhostAction Wave Sweeps Git History for Cloud…](https://cdn.brew.new/email-preview-d7b3d5c0b2d7c28e-tracking_r57tpef5mjy9r28sk2z3xmb2358g6av4-1791861675219.png) ## Email content socket-weekly-new-header Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes. TOP STORY New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials Two compromised maintainer accounts pushed a fake security-audit workflow into 346 repositories, including Uber’s athenadriver and the popular game engine pyxel. Earlier GhostAction waves grabbed whatever was in GitHub Actions secrets, and this one also sweeps the working tree and the full git history for AWS, Anthropic, OpenAI, and GitHub keys. It pulls every branch and tag, which means it reaches credentials that were committed and later deleted. MORE NEWS TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack A malicious version of tensorlake, the npm SDK for an AI agent sandboxing platform, shipped a preinstall hook built to harvest npm, GitHub, AWS, and Kubernetes credentials and republish itself using the victim’s publishing identity. It resolves its C2 address through an Ethereum contract rather than a hardcoded domain, and it installs a monitor designed to wipe the user’s home directory if the stolen GitHub token is revoked while the monitor is still running. arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions arXiv is capping every author at two submissions a month after a surge in thin papers of narrow scope, dense AI-written papers, and single pieces of work sliced into several submissions. September brought a record 40,363 submissions and close to 9,000 support tickets. Researchers are pushing back on the blanket cap, arguing it punishes everyone for a small group consuming a disproportionate share of moderator time. MORE WORTH READING Expanding the Cyber Verification Program How Should Enterprises Transition to the Agentic Era? 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials Trusted Publishing Beyond npm and PyPI OpenAI “rogue” agent activities found on Wikimedia projects npm staged publishing now supports creating new packages X 512x512-logo-27148 LinkedIn bluesky Socket Inc. Secure your supply chain. Ship with confidence. 2810 N Church St., Suite 71517, Wilmington,DE, 19802 Book a Demo • Unsubscribe [Open and remix this design](https://brew.new/templates/socket/socket-weekly-new-ghostaction-wave-sweeps-git-history-for-cloud) [Browse email designs](https://brew.new/browse/templates)