Semgrep | 🚨 Popular GitHub Action tj-actions/changed-files is compromised
semgrep.dev
Popular GitHub Action tj-actions/changed-files has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.
  • chaospatternsOPEnglish
    15·
    2 days ago

    Here’s a good reason why you should pin to specific sha hashes, not just release versions.

  • bleistift2@sopuli.xyzEnglish
    12·
    22 hours ago

    PrOtEcTiNg ThE sUpPlY cHaIn Is ImPoRtAnT tO uS. tHeReFoRe We NoW fOrCe 2Fa On YoU.