
- Socket uncovers large-scale GitHub spam campaign abusing “Discussions” notifications
- Fake advisories with bogus CVEs trick developers into downloading malware via cloud-hosted links
- Thousands of identical posts observed, showing coordinated effort to target developer credentials and projects