Surprise: When Dependabot Contributes Malicious Code

In July 2023, malicious actors infiltrated hundreds of GitHub repositories by impersonating Dependabot, stealing users' personal access tokens, and injecting code that exfiltrates project secrets and adds a password-stealer malware effect. This incident highlights the increasing sophistication of supply chain attacks, emphasizing the importance of vigilance and using fine-grained personal access tokens to mitigate risks, especially as non-enterprise users lack access to token access logs in the audit section.