Backdoored developer tool that stole credentials escaped notice for 3 months

AWS credentials and private repository tokens could allow self-perpetuating attacks.
https://bit.ly/3ssg7rn