nx-console

I found more details on how this particular attack worked: https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://github.com/nrwl/nx-console/issues/3148 So the extension basically rewrites files in `.github/workflows` and pushes them to GitHub, which then sends all the sensitive information to the attacker. It also attempts to plant a malware on the local machine, too. My impression is that it would be hard for an OS-level sandbox to completely stop this attack. The sandbox needs to determine whether if a git push originating from an IDE is malicious.

Because the link is blogspam. https://github.blog/security/investigating-unauthorized-acce... links to https://github.com/nrwl/nx-console/security/advisories/GHSA-... Nx Console

https://github.com/nrwl/nx-console Looks like it

Per security advisory on GitHub: Root Cause One of our developers was compromised by a recent supply-chain compromise on Tanstack, which leaked their GitHub credentials through the GitHub CLI (gh). This allowed the attacker to run workflows on our GitHub repository as a contributor. More links: https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...

It’s nx console https://github.com/nrwl/nx-console/security/advisories/GHSA-...

I wonder if this was the compromised nx console extension that bit me yesterday. The timing seems identical. See https://github.com/nrwl/nx-console/security/advisories/GHSA-...

There are rumours that was NX Console VS code extension https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...

If I had to guess it is the NX console extension that was compromised yesterday. But I’m not 100% sure. https://github.com/nrwl/nx-console/security/advisories/GHSA-...

This list is incomplete - at least one other package (nx-console VS code extension; 2.2M downloads) was compromised yesterday with this worm: if suitably qualified/connected people are reading this, it could be worth following that dependency chain too in case there are more. See here: https://github.com/nrwl/nx-console/security/advisories/GHSA-... PS: I posted on HN to try and alert people right after it was compromised but sadly got almost no upvotes :-(

Incidentally, this is one of the first times where an LLM was genuinely useful in helping me quarantine & identify the issue with a degree of certainty. If you want further information on how the attack was obfuscated & executed, I posted in the nx-console Issues board [here](https://github.com/nrwl/nx-console/issues/3140) - (apols for the LLM-assisted post, as you would imagine I was in something of a hurry to report it)

These tips are great, but they don’t address some of the core ways that these supply chain attacks may happen: global modules and npm modules installed with editor extensions. So `yarn global add nx` will still install the latest version by default, unless you specifically have a `~/.yarnrc` disallowing lifecycle scripts they will still be executed. Using a package manager that doesn’t allow lifecycle scripts by default is the solution here I guess. I don’t know what the solution is for stuff like [this](https://github.com/nrwl/nx-console/blob/d2fa56509679fc942bbc...) where the editor plugin automatically uses the latest version, or where in general you have little control over what version is used. Any eslint, typescript, nx, prettier, etc plugin will presumably depend on their corresponding package from npm, and if any of those gets com