News for hackers. Stuff that matters.

A comment on Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem. Parent comment

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by t0mas88 on Sunday December 14, 2025 @10:44AM (#46263844)
But the attacker could just create a branch, merge request and then merge that?
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by benoau on Sunday December 14, 2025 @12:51PM (#46265095)
They can't with git by itself, but if you're also signed in to GitHub or BitBucket's CLI with an account able to approve merges they could use those tools.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by x0x0 on Sunday December 14, 2025 @01:52PM (#46265653)
We require review on PRs before they can be merged.
[ Parent | on HN ]