Supply chain attack alert: .github/setup.js

antihero3 pts0 comments

Our org GitHub just got compromised massively by a supply-chain attack. Vectors are* Claude hooks* Gemini hooks* Cursor setup* VScode tasksIt adds all of the above to execute node .github/setup.js, an obfuscated file.Check infected: `rg --hidden --no-ignore node .github/setup.js`It spreads by adding mimic d skip-ci commits to open PRs which then get merged.Payload is obfuscated, available on request.If this is already a known one in the world, apologies, it hit us at around 10PM BST last night, the damage would have been incredible.Still trying to identify the original source.

github setup supply chain attack hooks

Related Articles