--- title: I Wasn't Supposed to Notice That Commit · Nikhil Gautam description: A developer recounts discovering a supply chain attack after noticing an unusual commit pushed by their organization's DevOps account across multiple... canonical: https://daily.dev/posts/gr4jifq2u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: I Wasn't Supposed to Notice That Commit · Nikhil Gautam | daily.dev og:description: A developer recounts discovering a supply chain attack after noticing an unusual commit pushed by their organization's DevOps account across multiple... og:url: https://daily.dev/posts/gr4jifq2u og:image: https://api.daily.dev/og/posts/gr4jIFq2U.png og:image:alt: Post cover image og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # I Wasn't Supposed to Notice That Commit · Nikhil Gautam **[Developer's Journey](https://daily.dev/sources/devjourney)** · [@nikhil3](https://daily.dev/nikhil3) · 91 upvotes · 7 comments ## Summary A developer recounts discovering a supply chain attack after noticing an unusual commit pushed by their organization's DevOps account across multiple repositories. The commit added a malicious postinstall script to package.json that downloaded and executed a hidden binary via curl. Investigation revealed the DevOps account's Personal Access Token had been compromised and had overly broad write access to many repos. The team removed the malicious changes, revoked the compromised credentials, and reviewed permissions. The takeaway is that excessive access tied to a single compromised credential can put an entire organization at risk, and that curiosity about small anomalies can catch security incidents before they escalate. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@byteoutlaw** · 11 upvotes > What the f. You were exactly supposed to notice this hahaha! 🤣 **@trevorsuna** · 2 upvotes > That unexpected postinstall change is exactly the kind of small anomaly worth investigating. The broader fix is limiting token scope so one compromised DevOps account cannot write across every repository, then watching for new install scripts and unusual commits as part of routine review. **@ristotoldsep** · 0 upvotes > Nice catch. A mystery `postinstall` is an instant nope from me. **@markojr** · 0 upvotes > As a DevOps engineer i will say this: DevOps is a temporary job-description ... it should be a skill-set Developers and Operations share and not a dedicated role. > Companies who fail to understand that they have to upskill their stuff will suffer a lot of problems. **@hunterxcobby** · 0 upvotes > This is a solid post > > It’s nice reading a real world case of token comprising. > > I also find it useful that the blog was written in plain English as much as possible that even beginners will get an idea of what’s going on ## Similar posts on daily.dev - [Official SAP npm packages compromised to steal credentials](https://daily.dev/posts/official-sap-npm-packages-compromised-to-steal-credentials-c73lsexvg) · BleepingComputer · 0 upvotes · 0 comments - [TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages](https://daily.dev/posts/tanstack-details-sophisticated-npm-supply-chain-attack-that-compromised-42-packages-bjod4ssnq) · InfoQ · 0 upvotes · 0 comments - [From typos to takeovers: Inside the industrialization of npm supply chain attacks](https://daily.dev/posts/from-typos-to-takeovers-inside-the-industrialization-of-npm-supply-chain-attacks-j99s1btzj) · CSO Online · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#npm](https://daily.dev/tags/npm), [#devsecops](https://daily.dev/tags/devsecops) [View this post on daily.dev](https://daily.dev/posts/gr4jifq2u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/gr4jifq2u","headline":"I Wasn't Supposed to Notice That Commit · Nikhil Gautam","text":"Shared: I Wasn't Supposed to Notice That Commit · Nikhil Gautam","url":"https://daily.dev/posts/gr4jifq2u","datePublished":"2026-09-20T19:40:53.193Z","dateModified":"2026-09-20T19:40:53.196Z","author":{"@type":"Person","name":"Nikhil","url":"https://daily.dev/nikhil3","image":"https://avatars.githubusercontent.com/u/123929646?v=4","description":"Backend Engineer | Building and Scaling Real-World APIs | Learning From Production","worksFor":{"@type":"Organization","name":"Medoc Health","logo":"https://res.cloudinary.com/daily-now/image/upload/s--tlVupH_6--/f_auto/v1726094825/companies/medochealth"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":1900}},"image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":91},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":7}],"sharedContent":{"@type":"WebPage","url":"https://api.daily.dev/r/PTjxOM9HW"},"comment":[{"@type":"Comment","text":"What the f. You were exactly supposed to notice this hahaha! 🤣","datePublished":"2026-09-21T08:37:52.677Z","url":"https://daily.dev/posts/gr4jIFq2U#c-86mhmu3fi","author":{"@type":"Person","name":"Jacob B. Bonde","url":"https://daily.dev/byteoutlaw","image":"https://media.daily.dev/image/upload/s--veTChHK7--/f_auto/v1733220070/avatars/avatar_5cQvIZKr5tDFDotVDjulg"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11}},{"@type":"Comment","text":"That unexpected postinstall change is exactly the kind of small anomaly worth investigating. The broader fix is limiting token scope so one compromised DevOps account cannot write across every repository, then watching for new install scripts and unusual commits as part of routine review.","datePublished":"2026-09-22T02:42:56.575Z","url":"https://daily.dev/posts/gr4jIFq2U#c-Adkblj2QY","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}},{"@type":"Comment","text":"Nice catch. A mystery postinstall is an instant nope from me.","datePublished":"2026-09-22T07:30:56.406Z","url":"https://daily.dev/posts/gr4jIFq2U#c-63tV7xPGd","author":{"@type":"Person","name":"Risto Tõldsep","url":"https://daily.dev/ristotoldsep","image":"https://lh3.googleusercontent.com/a/ACg8ocLDWc6mZn0JwNmXXw6WY0L_HJ6pegzRttooC5VgtXESHSj3MNYx=s96-c"}},{"@type":"Comment","text":"As a DevOps engineer i will say this: DevOps is a temporary job-description … it should be a skill-set Developers and Operations share and not a dedicated role.\nCompanies who fail to understand that they have to upskill their stuff will suffer a lot of problems.","datePublished":"2026-09-22T07:30:05.155Z","url":"https://daily.dev/posts/gr4jIFq2U#c-kK1o7lDTJ","author":{"@type":"Person","name":"Marko Jozic-Reyes","url":"https://daily.dev/markojr","image":"https://media.daily.dev/image/upload/s--TvIfWcng--/f_auto/v1769558803/avatars/avatar_x9cfuU5ai02W3BPEbroGK?_a=BAMAMiiu0"}},{"@type":"Comment","text":"This is a solid post\nIt’s nice reading a real world case of token comprising.\nI also find it useful that the blog was written in plain English as much as possible that even beginners will get an idea of what’s going on","datePublished":"2026-09-23T07:29:07.567Z","url":"https://daily.dev/posts/gr4jIFq2U#c-rF3qfgi87","author":{"@type":"Person","name":"Solomon Cobby Sefah","url":"https://daily.dev/hunterxcobby","image":"https://lh3.googleusercontent.com/a/ACg8ocKNpbNFrmH1JM88FC1WMhf-1hjOI4g46-HEXZ36uPER-ValVkmAig=s96-c"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/devjourney","name":"Developer's Journey"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Developer's Journey","item":"https://daily.dev/squads/devjourney"},{"@type":"ListItem","position":3,"name":"I Wasn't Supposed to Notice That Commit · Nikhil Gautam"}]} ```