The SpotBugs maintainer has since confirmed that the PAT that was used as a secret in the workflow was the same access token that was later used to invite “jurkaofavak” to the “spotbugs/spotbugs” repository. The maintainer has also rotated all of their tokens and PATs to revoke and prevent further access by the attackers.
One major unknown in all this is the three-month gap between when the attackers leaked the SpotBugs maintainer’s PAT and when they abused it. It’s suspected that the attackers were keeping an eye out on the projects that were dependent on “tj-actions/changed-files” and waited to strike a high-value target like Coinbase.
“Having invested months of effort and after achieving so much, why did the attackers print the secrets to logs, and in doing so, also reveal their attack?,” Unit 42 researchers pondered.
New research from The University of Manchester may reshape our understanding of what happens to the immune system when we fast. The study on mice shows that the brain’s hypothalamus controls how the immune system adapts during fasting, through a handful of highly specialized neurons responsible for making animals hungry.
Published in Science Immunology, the study shows the brain’s perception of hunger or fullness, rather than actual eating or caloric restriction, is enough to drive changes in the body’s immune cells.
The findings cast doubt on the current view that a lack of nutrients alone controls how the immune system responds to fasting, indicating the brain has a critical role, beyond the simple absence of food.