Vulnerable Claude code in GitHub action led to stolen NPM keys
Seems like a ton (over 1k) of people were affected because of an auto updating VS Code extension. Check your bashrc/zshrc and GitHub account if you use nx
https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598cOpen linkView original on lemmy.world
This doesn't look like a Claude issue or an AI issue, this looks like someone pushed malicious code to a repo and they where trying to make AI tools ignore these files? I'm not reading this wrong am I?
The command injection in the GitHub action code was written by Claude[1]. That was used to get the NPM key and then malware was pushed to NPM.
[1] https://github.com/nrwl/nx/pull/32458