Vulnerable Claude code in GitHub action led to stolen NPM keys

https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c

Seems like a ton (over 1k) of people were affected because of an auto updating VS Code extension. Check your bashrc/zshrc and GitHub account if you use nx

25 points · 2 comments · view on lemmy.world

2 Comments

Solemarc@lemmy.world · 5 pts · 354d (1 reply)

This doesn't look like a Claude issue or an AI issue, this looks like someone pushed malicious code to a repo and they where trying to make AI tools ignore these files? I'm not reading this wrong am I?

qqq@lemmy.world · 6 pts · 354d

The command injection in the GitHub action code was written by Claude[1]. That was used to get the NPM key and then malware was pushed to NPM.

[1] https://github.com/nrwl/nx/pull/32458