It appears as though the attackers behind the Nx supply chain attack on Wednesday are now using leaked GitHub tokens to make private GitHub repositories public (and renaming them to s1ngularity-repository-XXXXX in the process). 7.2k repositories affected at time of writing.

https://xcancel.com/adnanthekhan/status/1961152614055207039

Comments (1)

fennec-posix · 4h ago

yeah, just did a search on github, ouch. This looks bad.

No comments yet

Google will allow only apps from verified developers to be installed on Android (9to5google.com)

Gemini 2.5 Flash Image (developers.googleblog.com)

FFmpeg 8.0 (ffmpeg.org)

Ask HN: The government of my country blocked VPN access. What should I use?

What are OKLCH colors? (jakub.kr)

Dissecting the Apple M1 GPU, the end (rosenzweig.io)

A German ISP changed their DNS to block my website (lina.sh)

Claude for Chrome (anthropic.com)

DeepSeek-v3.1 (api-docs.deepseek.com)

AI tooling must be disclosed for contributions (github.com)

Show HN: Base, an SQLite database editor for macOS (menial.co.uk)

A visual introduction to big O notation (samwho.dev)

Comet AI browser can get prompt injected from any site, drain your bank account (twitter.com)

Go is still not good (blog.habets.se)

We regret but have to temporary suspend the shipments to USA (olimex.wordpress.com)

U.S. government takes 10% stake in Intel (cnbc.com)

Waymo granted permit to begin testing in New York City (cnbc.com)

Monodraw (monodraw.helftone.com)

Ban me at the IP level if you don't like me (boston.conman.org)

Google has eliminated 35% of managers overseeing small teams in past year (cnbc.com)

Michigan Supreme Court: Unrestricted phone searches violate Fourth Amendment (reclaimthenet.org)

Scientist exposes anti-wind groups as oil-funded, now they want to silence him (electrek.co)

US Intel (stratechery.com)

Altered states of consciousness induced by breathwork accompanied by music (journals.plos.org)

Unexpected productivity boost of Rust (lubeno.dev)

Io_uring, kTLS and Rust for zero syscall HTTPS server (blog.habets.se)

Nx compromised: malware uses Claude code CLI to explore the filesystem (semgrep.dev)

Are OpenAI and Anthropic losing money on inference? (martinalderson.com)

How to build a coding agent (ghuntley.com)

What makes Claude Code so damn good (minusx.ai)

Framework Laptop 16 (frame.work)

Building the mouse Logitech won't make (samwilkinson.io)

Line scan camera image processing for train photography (daniel.lawrence.lu)

The Therac-25 Incident (2021) (thedailywtf.com)

Proposal to Ban Ghost Jobs (cnbc.com)

The GitHub website is slow on Safari (github.com)

Malicious versions of Nx and some supporting plugins were published (github.com)

A teen was suicidal. ChatGPT was the friend he confided in (nytimes.com)

Ask HN: Why hasn't x86 caught up with Apple M series?

Manim: Animation engine for explanatory math videos (github.com)

I Am An AI Hater (anthonymoser.github.io)

Everything I know about good API design (seangoedecke.com)

We put a coding agent in a while loop (github.com)

95% of Companies See 'Zero Return' on $30B Generative AI Spend (thedailyadda.com)

Show HN: A zoomable, searchable archive of BYTE magazine (byte.tsundoku.io)

4chan will refuse to pay daily online safety fines, lawyer tells BBC (bbc.co.uk)

macOS 26 Tahoe's Dead Canary Utility App Icons (daringfireball.net)

Ghrc.io appears to be malicious (bmitch.net)

Google's Liquid Cooling (chipsandcheese.com)

Uncomfortable Questions About Android Developer Verification (commonsware.com)

Tell HN: 2nd wave of Nx attack: private GitHub repos are being made public

Comments (1)