Securing CI/CD in an agentic world: Claude Code Github action case

Microsoft Threat Intelligence published a series of posts exposing high-risk threats to developer and CI/CD environments: a prompt-injection vulnerability in the Claude Code GitHub Action that could expose workflow secrets, multiple large-scale npm supply-chain campaigns (including the Red Hat “Miasma” credential-stealer, dependency-confusion and typosquatting campaigns) that steal cloud/CI/CD credentials and propagate, a cryptojacking campaign abusing SEO poisoning and remote-access tooling, and analysis of a self‑propagating Go ransomware family. The collection also updates failure-mode tax­