TI

Hacker attacks and data breaches are no longer exceptions. Until when?

Recently, the company I've been working for faced a malware attack through a GitHub user. This GitHub account had its credentials stolen somehow, which ended up making the hacker's life easier to implant a malicious obfuscated JavaScript payload into tailwind.config.ts and spread it across a few other projects. It wasn't clear how the code worked. But you can check out more info here: PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos.


Everyone was blocked from making any push/pull/yarn until we figured out how it worked and how to prevent it from spreading further. In the end, we ran a few code checkers and rotated sensitive tokens.


The key point is: this happened at dawn, between 3–5 am. The affected user had high admin powers across plenty of projects, so the hacker could just force push without needing any extra effort. How they found out exactly who had so much power is a good question. A very very good bet.


That morning was tense, full of stress and investigation. Things could have been much worse if someone hadn't noticed it early in the morning.

Lucky for me, that day I started working a bit later than usual. When I sat down to read all the threads, I saw all the chaos that had been unfolding in the dev channel. At least the day ended up fine, no big problems overall, nobody else affected, all good. Aside from the first dev impacted, he had a few nightmares for sure.


All of this triggered several red flags, especially around permissions and the need for stricter rules in branch controls. Fair enough, right? Since I also had some "super powers," I had them all taken from me. I believe it's better this way. Better to prevent than to deal with it again. As Peter Parker's Uncle Ben says: "With great power comes great responsibility". Isn't it?

Mainly in an environment where a lot of developers have admin roles and work on multiple projects at once. We need to restrict things carefully and control project security more and more every day.


Our incident was small scale. But it made me pay more attention to what's been happening out there. I've seen many leaks, attacks, and large companies being hacked recently. Lovable (Apr/2026), Vercel (Apr/2026), Salesforce (Aug/2025), Red Hat GitLab (Oct/2025) and these are just a few. I have the impression that things weren't like this a while ago. It seems recent. Anyway, as these situations are becoming more frequent, we can say they are no longer exceptions. What's happening that we haven't caught yet? Programming has been changing continuously, that's for sure. But what else?


To say the reason is the rise of AI is, in my view, an overly simplistic take that minimizes our own responsibilities. However, there is a missing piece in this puzzle, something that is beyond our reach. Perhaps we'll discover it in the coming chapters written in 0s and 1s. I hope so.


Final Words

In case you've also been impacted by something similar (hopefully not), here's what we did to make sure everyone was safe:

  • If you have Claude Code, you can use a prompt like: "Please check my whole system to see if I'm still affected by the following malware"
  • Run this scanner script, starting with the drive that contains your profile. This should be a system-wide check, but you can start with your main local folder.
  • Rotate personal tokens such as GH_TOKEN, NPM_TOKEN, and anything else that could give sensitive access to attackers
  • Delete the affected branch or remove the malicious code

Read more about recent attacks:

You can also check out more below:

Back to Blog