Experimental News Clipping Site

Tag: third-party actions

  • Hacker News: Whose code am I running in GitHub Actions?

    —

    by

    Kurt Seifried
    in

    Source URL: https://alexwlchan.net/2025/github-actions-audit/ Source: Hacker News Title: Whose code am I running in GitHub Actions? Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a recent security issue with the tj-actions/changed-files GitHub Action, highlighting the risks of mutable Git tags as opposed to immutable commit references in CI/CD processes. It emphasizes the…

  • Alerts: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 Source: Alerts Title: Supply Chain Compromise of Third-Party GitHub Action, CVE-2025-30066 Feedly Summary: A popular third-party GitHub Action, tj-actions/changed-files (tracked as CVE-2025-30066), was compromised. This GitHub Action is designed to detect which files have changed in a pull request or commit. The supply chain compromise allows for information disclosure of secrets including,…

  • Hacker News: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised Source: Hacker News Title: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos Feedly Summary: Comments AI Summary and Description: Yes Summary: A critical security incident has been identified involving the tj-actions/changed-files GitHub Action, which has been compromised to leak sensitive CI/CD secrets. This incident underscores the urgency for security and…

  • Slashdot: GitHub Actions Typosquatting: a High-Impact Supply Chain Attack-in-Waiting?

    —

    by

    system automation
    in

    Source URL: https://developers.slashdot.org/story/24/09/07/0427219/github-actions-typosquatting-a-high-impact-supply-chain-attack-in-waiting?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: GitHub Actions Typosquatting: a High-Impact Supply Chain Attack-in-Waiting? Feedly Summary: AI Summary and Description: Yes Summary: The text discusses the vulnerabilities intrinsic to the GitHub Actions ecosystem, particularly focusing on the threat of typosquatting. It highlights how this form of attack can lead to significant risks in software supply…