GoKawiil
Tech News
A project called Loopt, posted on Show HN, converts source code written in TypeScript, Python, Go, Rust, or custom plugin languages into standard GitHub Actions YAML files. It includes an init command that scaffolds a starter workflow based on detected project files (like package.json or Cargo.toml) and an import command to convert existing YAML workflows back into editable source code.
Wiz Research has tracked an ongoing campaign called Gheist, active since September 15, 2026, that uses compromised GitHub tokens to plant a malicious 'sync-check' workflow across repositories. The workflow base32-encodes repository secrets to bypass GitHub's log masking, prints them to a workflow log, then an automated process downloads and deletes the log within seconds. Wiz has found over 13,500 planted branches across more than 850 compromised accounts, including private and enterprise repositories, and reported the activity to GitHub.
A developer has released RemoveMacAI, an open-source command-line tool that disables Apple Intelligence features on macOS 27 and deletes the AI models left on disk, since Apple removed the single toggle for the feature in this release. The tool installs via a one-line script or Homebrew, shows users the current state before making changes, and can fully revert them. It also blocks macOS from re-downloading the models afterward.
GitHub Actions repositories actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled in May after being compromised in the Mini Shai-Hulud supply-chain attack, were reinstated by their maintainer starting September 16 without removing the malicious code. Socket researchers found the release tags still pointed to the original tainted commit, meaning any workflow referencing those version tags resumed downloading and executing the malware payload through at least September 25.
Rickub is a new Git hosting platform that bundles organization and repository management, merge requests, and an integrated AI reviewer called Athena that leaves inline comments and verdicts on every merge request. It also supports running existing GitHub Actions workflows unchanged, hosting OCI artifacts like container images, Helm charts, SBOMs and WASM in the same namespace as code, and offers CLI, API and MCP access using one token and permission model.
CloudX built and released cloudx-io/setup-go, a drop-in replacement for GitHub's official actions/setup-go, after finding that the official action caused parallel jobs to interfere with each other and repeatedly pull stale cache data. In backtests on CloudX's monorepo running lint, test, and build jobs in parallel, the new action eliminated an estimated 86% of unnecessary work performed by the default setup, cutting test job runtimes by 69%.