Polyfill supply chain attack that hit more than 100,000 websites has now been linked to North Korean threat actors.
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.