The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
Polyfill supply chain attack that hit more than 100,000 websites has now been linked to North Korean threat actors.