#OpenSourceProjects

GitHub Actions Artifacts Leak Tokens and Expose Cloud Services and Repositories

by

August 16, 2024 at 05:51PM GitHub Actions artifacts generated during CI/CD workflows may inadvertently expose tokens for third-party cloud services and GitHub, posing a risk to repositories and services. Palo Alto Networks warns of misconfigurations and security defects allowing threat actors to compromise repositories and steal secrets. Avital suggests proactive security measures to mitigate these … Read more

Attacker Social-Engineered Backdoor Code Into XZ Utils

by

April 24, 2024 at 05:27PM Attacks like those experienced by SolarWinds and CodeCov show that adversaries can employ social engineering to execute supply chain attacks, as demonstrated by the backdoor introduction in the XZ Utils open source utility. This incident, along with warnings from the Open Source Security Foundation, highlights the need for vigilance in … Read more