Source / SafeDep
A hijacked coding assistant opens a new path for supply-chain attacks
A Mandiant case described by SafeDep shows how a coding-assistant session, a poisoned dependency, and OAuth tokens helped spread Shai-Hulud across about 100 repositories.

