Leaked SpotBugs Token Triggered Massive GitHub Supply Chain Attack Targeting Coinbase

A sophisticated supply chain attack targeting Coinbase was traced to a single stolen GitHub token from SpotBugs. Beginning in November 2024, attackers exploited a vulnerable workflow to steal a maintainer's PAT, then methodically compromised multiple repositories including Reviewdog and tj...