TruffleHog

Assess

Tools

Open-source secret-scanning tool for finding exposed credentials in code and repositories.

Why it's here

Placed in Assess: 2 article(s) of evidence from 2 source(s), led by security coverage, with 1 in the last 30 days. Confidence 39%.

8Hacker News·9/15/2026security
Strix Finds Exposed GitHub Admin Token in Baseten Production Image
A security test using the autonomous hacking agent Strix reportedly uncovered a live GitHub personal access token in a Baseten container image, granting repository-level admin and push access to internal repos. Baseten confirmed the issue as critical and rotated the token quickly after disclosure.
10The New Stack·8/31/2026security
Shai-Hulud Worm Turns npm Publishing Into a Supply-Chain Attack
The article describes a series of self-propagating npm supply-chain attacks, starting with Shai-Hulud and later variants that stole credentials, republished poisoned packages, and spread without human action. The latest variant, ChainDrop, abused a legitimate signed release pipeline and valid SLSA attestations to bypass trust checks, while also using an Ethereum smart contract for command infrastructure.