HIGH ALERT: Ongoing targeting of online code repositories

The Australian Signals Directorate (ASD) / ACSC warns of increased targeting of online code repositories, where threat actors use phishing, social engineering, compromised credentials or tokens, and infected packages to gain access. Observed post-compromise activities include modifying public packages to enable supply-chain compromises, scanning repositories for secrets and keys, exfiltrating and publishing credentials, and migrating private repositories to public; the advisory recommends investigating affected systems, validating packages, monitoring for secret scanning, rotating exposed secrets, adopting SBOM practices, and contacting ACSC for assistance.