a fake bug fix PR hid a credential stealer in astro.config.mjs that used blockchain to receive commands

← 피드로

a malicious pull request was submitted in a 57k star github repo Egonex-AI/Understand-Anything and the pr description was also convincing, the test plan was fake and the real payload is hidden behind hundreds of whitespace characters on the last diff line. astro.config.mjs runs as a…

원문 보기 ↗