If they'd waited a week before using their ill-gotten credentials to update the ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

bobbylarrybobby 11 months ago | parent | context | favorite | on: We all dodged a bullet

If they'd waited a week before using their ill-gotten credentials to update the packages, would they have been detected in that week?

captn3m0 11 months ago [–]

That is what the tj-actions attacker did: https://unit42.paloaltonetworks.com/github-actions-supply-ch...

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact