Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos

A poisoned Nx Console VS Code extension compromised an employee device and enabled exfiltration of about 3,800 GitHub repositories by TeamPCP. GitHub contained the incident and rotated critical secrets while monitoring for further activity. The Nx team linked the extension compromise to a hacked developer system following the recent TanStack supply chain attack, which also impacted OpenAI, Mistral AI, and Grafana Labs. Grafana Labs faced an extortion attempt but refused to pay. The Mini Shai-Hulud campaign and public release of Shai-Hulud code indicate a shift toward worm-like software supply chain threats that provide attackers with reusable blueprints. Phishing became more targeted and realistic, while botnets continued scanning and exploiting internet-exposed systems.

"GitHub Breached via Nx Console VS Code Extension—GitHub officially confirmed that the breach of its internal repositories was the result of a compromise of an employee device involving a poisoned version of the Nx Console Microsoft Visual Studio Code (VS Code) extension. The attack is said to have allowed the threat actor, a cybercriminal group known as TeamPCP, to exfiltrate about 3,800 repositories. GitHub said it has taken steps to contain the incident and rotated critical secrets, adding it's continuing to monitor the situation for follow-on activity."

"The Nx team revealed that the extension, nrwl.angular-console, was breached after one of its developers' systems was hacked in the wake of the recent TanStack supply chain attack. Other companies that were impacted by the TanStack compromise include OpenAI, Mistral AI, and Grafana Labs. Grafana Labs was also the target of an extortion attempt, but the company said it refused to pay the hackers who had threatened to release the company's codebase."

"The incidents are just some examples of the long tail of downstream victims emerging from the Mini Shai-Hulud campaign. This, coupled with TeamPCP's public release of the Shai-Hulud code, marks a significant evolution in software supply chain threats, as it gives attackers a ready-made blueprint for fleshing out similar worms targeting open-source repositories and developer environments."

"Phishing crews are getting smarter too - less obvious scam junk, more targeted stuff that actually looks real. Meanwhile, botnets are grabbing anything exposed to the internet like it's free candy. The Internet's still a dumpster fire."

Read at The Hacker News