GitHub Breach via Nx Console Highlights Growing Danger of Supply Chain Exploits.
GitHub Hit by Multi-Tier Supply Chain Attack: Hacker Group Compromises 3,800 Internal Repositories via Rogue VS Code Extension In a chilling reminder of the volatility within modern software development pipelines, GitHub has confirmed a security breach affecting its internal infrastructure. A threat actor has successfully infiltrated and exfiltrated data from approximately 3,800 internal repositories . The incident highlights an incredibly sophisticated, multi-tiered Supply Chain Attack that weaponized trusted, mainstream development tools against GitHub’s own engineers. The Three-Tier Poisoning Chain Breakdown The anatomy of this attack reveals a meticulously executed domino effect spanning three distinct layers of the software ecosystem: The Root Infiltration (The TanStack NPM Compromise): The breach originated at the foundational package level, where malicious actors managed to poison a widely used TanStack package hosted on the public npm registry. The Intermediate Carrier (Nx...