200-plus impressively convincing GitHub repos are serving up malware

Kaspersky reported a multi-year ‘GitVenom’ campaign that hosted 200+ fake GitHub repositories containing trojans, info-stealing code and crypto-wallet hijackers that have reportedly stolen nearly $500,000; CISA added two actively exploited vulnerabilities (CVE-2017-3066 in Apache BlazeDS and CVE-2024-20953 in Oracle Agile PLM) to its Known Exploited Vulnerabilities list requiring urgent patching; the digest also notes staff resignations at the renamed US Digital Service over security concerns and a LastPass client update recommended to resolve CPU issues.