Nx Console VS Code extension was the initial access vector in the GitHub breachtwitter.com 6 pointsvldszn3 months ago1 commentSaveHideCopy link On HNComments−vldsznOP3moPer security advisory on GitHub:Root CauseOne of our developers was compromised by a recent supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh). This allowed the attacker to run workflows on our GitHub repository as a contributor.More links:https://github.com/nrwl/nx-console/security/advisories/GHSA-...https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...
Comments
Per security advisory on GitHub:
Root Cause
One of our developers was compromised by a recent supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh). This allowed the attacker to run workflows on our GitHub repository as a contributor.
More links:
https://github.com/nrwl/nx-console/security/advisories/GHSA-...
https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...