Seems like a ton (over 1k) of people were affected because of an auto updating VS Code extension. Check your bashrc/zshrc and GitHub account if you use nx
Vulnerable Claude code in GitHub action led to stolen NPM keys
https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c
2 Comments
Solemarc@lemmy.world · 5 pts · 354d
This doesn't look like a Claude issue or an AI issue, this looks like someone pushed malicious code to a repo and they where trying to make AI tools ignore these files? I'm not reading this wrong am I?
qqq@lemmy.world · 6 pts · 354d
The command injection in the GitHub action code was written by Claude[1]. That was used to get the NPM key and then malware was pushed to NPM.
[1] https://github.com/nrwl/nx/pull/32458