2 ms·
> Can't this be detected? Not really. Contrary to OP belief, there are tools that claim to detect such malicious packages. I wonder how effective they are.
by kjok 5y ago
> Can't this be detected? Not really.
Contrary to OP belief, there are tools that claim to detect such malicious packages. I wonder how effective they are.
- varunsharma07 5y agoHere is one such tool for GitHub Actions: https://github.com/step-security/harden-runner https://github.com/step-security/harden-runner. It would have detected and blocked the call to pastebin.com in this scenario. I am the maintainer of this tool.