The Through-Line

Six hops: from one stolen token to GitHub

The spine of the campaign. Six events line up end-to-end. The stretched dashed segment marks the 53-day stretch of cascade and monetization that separates the early-March breakthrough from the May return.

53 days cascade (Mar 19-27) → monetization → May return
Trivy PwnRequest
1
Feb 27 aqua-bot PAT exfiltrated via CI exploit
Rotation failure
2
Mar 1 Incomplete credential rotation leaves door open
Trivy main strike
3
Mar 19 75/76 tags hijacked; cascades to LiteLLM, KICS, Telnyx
TanStack OIDC theft
4
May 11 GHA cache poison; 84 versions across 42 packages
Nx Console publish
5
May 18 VS Code extension; 5-day dwell; 6K activations
GitHub breach
6
May 18-19 ~3,800 internal repos exfiltrated
Feb 27 → May 19: 82 days from first token theft to GitHub internal repos Cascade: KICS, LiteLLM, Telnyx, Bitwarden, AntV, OpenAI, Grafana, Cisco...