GitHub got breached on May 18. Trellix disclosed theirs on May 1. Checkmarx and Trivy went down in March. Four companies that build security and developer tools for a living, all hit inside the same nine-week stretch. Not a zero-day among them.
Three of the four have published how it happened, and all three began the same way: a developer identity was compromised, and that identity had more reach than anyone realized. The fourth couldn’t say how it happened, and that silence teaches its own lesson.
GitHub: 18 minutes and 3,800 repos
A threat actor called TeamPCP pushed a poisoned version of Nx Console, a popular VS Code extension, to the marketplace on May 18. It was live for roughly 18 minutes before it was pulled. That was enough. A GitHub employee’s machine auto-updated, the payload harvested credentials and tokens, and the attacker used them to clone about 3,800 of GitHub’s internal repositories. Within a day, the stolen archive was listed for sale at over $50,000.
The extension was the delivery mechanism. The damage came from what one identity could reach: one employee’s credentials, thousands of repositories, and no signal that the identity had suddenly started behaving like an attacker instead of a developer.
Checkmarx and Trivy: one stolen credential, many victims
In March, the same group compromised Trivy, the widely used vulnerability scanner, and stole CI credentials in the process. Days later, those stolen credentials were reused to break into Checkmarx’s GitHub Actions workflows and plant a credential stealer.
No exploit anywhere in the chain. The attackers stole one set of pipeline credentials from Trivy and used them to break into Checkmarx. Then the tooling did the spreading for them: thousands of companies had pipelines configured to automatically pull the latest version of those Checkmarx workflows, so when the attackers swapped in a poisoned version, all of those pipelines ran it without anyone noticing anything had changed.
Trellix: the quiet one
Trellix disclosed unauthorized access to part of its source code repository on May 1. RansomHouse claimed responsibility a week later. There is no confirmed link to TeamPCP, and, notably, no published initial access vector at all: no timeline of when access began, how long it lasted, or how the attacker got in.
That gap is worth sitting with. Months later, one of the industry’s largest security vendors either cannot or will not say how someone reached its source code. Most organizations are in the same position: if it happened to them, they couldn’t answer “who accessed what, when, and was that normal for them” either.
The pattern underneath
Every one of these companies has a serious security team. GitHub understands software supply chains better than almost anyone alive. And the confirmed breaches all reduce to the same shape: an identity, an employee’s credentials, a CI token, a pipeline’s trust in an auto-updating workflow, had access that nobody was actively watching, and that access got used in a way it never had before.
A scanner can tell you a package has a vulnerability. It could not have told GitHub that one employee’s credentials were suddenly cloning 3,800 repositories, or told Checkmarx that a trusted workflow had quietly changed hours earlier. In every confirmed case here, the code was fine. What changed was how an identity was behaving, and nothing in these companies’ considerable tooling was watching for that.
So the uncomfortable question isn’t whether your scanners are good. It’s this: if one of your identities, a developer, a service account, a token sitting in a pipeline, started acting differently tomorrow, would anyone notice that day? Or would you reconstruct it from forensics weeks later, the way most of these companies had to?
The fix isn’t another scanner. It’s knowing who and what has access to your development environment, what they normally do with it, and noticing the moment that changes.
This is exactly what BlueFlag was built for: a continuous picture of every identity in your development environment, human, machine, and AI, what each can reach, and what normal looks like for each one, so the moment behavior changes, someone knows. If you want to see what that picture looks like for your own environment, our free Risk Assessment delivers it within 48 hours.
