3 ms·
ELI5, how was the malicious PR approved and merged? Are they using AI for automated code review too?
by BobbyTables2 1y ago
ELI5, how was the malicious PR approved and merged?
Are they using AI for automated code review too?
- danr4 1y agoseems like the npm repo got hacked and the compromised version was just uploaded
- david_allison 1y agoThe workflows were set up to execute with a read/write `GITHUB_TOKEN` for `nx` when a PR was created/edited (no approval necessary). See the security warnings on `pull_request_target` https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target https://docs.github.com/en/actions/reference/workflows-and-a... https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/ https://securitylab.github.com/resources/github-actions-prev...