Apr 4, 11:00 AM

GitHub Expands Security Tools After 39 Million Secrets Leaked in 2024 Supply Chain Attack Targeting Coinbase in March 2025 Linked to November SpotBugs Token

GitHub has expanded its security tools following a supply chain attack that resulted in the leak of 39 million secrets. The incident, traced back to a compromised SpotBugs access token, allowed attackers to exploit vulnerabilities within the GitHub ecosystem. The breach began when a SpotBugs maintainer inadvertently leaked a GitHub access token in November 2024. Attackers subsequently moved through various tools, including reviewdog, and ultimately targeted Coinbase in March 2025. The attack highlights the risks associated with token management and the importance of robust security measures in software development environments.

#GitHub #SpotBugs #Coinbase

Written with ChatGPT (GPT-4o mini).

Sources

Infosec Alevski 💻🕵️‍♂️@Alevskey
2 years ago
SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack: https://t.co/OCgMRVXG7Y by The Hacker News #infosec #cybersecurity #technology #news
Nicolas Krassas@Dinosn
2 years ago
SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack https://t.co/bKuoz9qqQA
The Hacker News@TheHackersNews
2 years ago
👀 $0 GitHub Action ➔ $B security nightmare. In Nov 2024, a SpotBugs maintainer accidentally leaked a GitHub access token. ⚡ Attackers exploited it—moving from SpotBugs ➔ reviewdog ➔ poisoning tj-actions/changed-files—before striking Coinbase in March 2025. ➡️ Details https://t.co/lYTurYkQGi

GitHub Expands Security Tools After 39 Million Secrets Leaked in 2024 Supply Chain Attack Targeting Coinbase in March 2025 Linked to November SpotBugs Token

Sources

Additional media