S1NGULARITY: SUPPLY CHAIN ATTACK LEAKS SECRETS ON GITHUB

Summary from the TLDR InfoSec newsletter

Multiple malicious versions of the popular Nx build system package were published to NPM on August 26. The attack leveraged AI command line tools to search for sensitive files, extracted credentials, and then attempted lockout by appending `sudo shutdown -h 0` to .bashrc and .zshrc files. The root cause of the supply chain attack was a flawed GitHub Action that allowed code injection through unsanitized PR titles combined with the `pull_request_target` trigger.