3 ms·

This is hilarious, the maven-lockfile project "Lockfiles for Maven. Pin your dependencies. Build with integrity" appears to have auto-merged a PR for the compro

by themgt 2y ago

This is hilarious, the maven-lockfile project "Lockfiles for Maven. Pin your dependencies. Build with integrity" appears to have auto-merged a PR for the compromised action commit. So the real renovate bot immediately took the exfiltration commit from the fake renovate bot and started auto-merging it into other projects: https://github.com/chains-project/maven-lockfile/pull/1111 https://github.com/chains-project/maven-lockfile/pull/1111

sureIy 2y ago
The fun part is that they used commits specifically for security, but then add an auto-updater. Might as well use tags.
mdaniel 2y ago
heh, timing is everything https://github.com/chains-project/maven-lockfile/issues/1085#issuecomment-2721863241 https://github.com/chains-project/maven-lockfile/issues/1085... > After some cleanup the changed-files (https://github.com/tj-actions/changed-files https://github.com/tj-actions/changed-files) action seems to be more work to remove. It would be awesome if it could be added to the allowlist > Done. Allowed all versions of this action. Should I pin it to one version in the allowlist (won't be convenient if renovate updates this dependency)?