26
Vulnerable Claude code in GitHub action led to stolen NPM keys (github.com)
submitted 1 year ago by to c/programming@programming.dev
2 comments fedilink hide all child comments
 

Seems like a ton (over 1k) of people were affected because of an auto updating VS Code extension. Check your bashrc/zshrc and GitHub account if you use nx

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 7 points 1 year ago*

The command injection in the GitHub action code was written by Claude[1]. That was used to get the NPM key and then malware was pushed to NPM.

[1] https://github.com/nrwl/nx/pull/32458

  • permalink
  • fedilink
  • source
  • parent