varunsharma07

6 ms·

31.
Popular Nx Build System NPM Package Compromised with Data Stealing Malware(stepsecurity.io)
10 points by varunsharma07 1y ago|2 comments
32.
by varunsharma07 1y ago
Nx package on npm hijacked to steal cryptocurrency wallets, GitHub/npm tokens, SSH keys, and environment secrets through sophisticated exfiltration attack
33.
Suspicious Tag Change in AWS's GitHub Action: What Happened and Why It Matters(stepsecurity.io)
3 points by varunsharma07 1y ago|1 comments
34.
by varunsharma07 1y ago
How an AWS release rollback triggered the same red flags as a supply chain attack and why treating every semantic version tag change as suspicious is key to protecting your CI/CD pipelines
35.
Num2words PyPI Package Compromised(stepsecurity.io)
22 points by varunsharma07 1y ago|6 comments
36.
by varunsharma07 1y ago
Popular Python Package num2words v0.5.15 Published Without Repository Tag, Linked to Known Threat Actor
37.
eslint-config-prettier npm package compromised(stepsecurity.io)
74 points by varunsharma07 1y ago|11 comments
38.
Grafana GitHub Actions Security Incident(stepsecurity.io)
10 points by varunsharma07 1y ago|0 comments
39.
by varunsharma07 2y ago
I’m Varun, CEO & Co-Founder of StepSecurity. StepSecurity detected and reported the tj-actions/changed-files compromise and has been actively helping the community recover from this incident. To support you in understanding what ha
40.
by varunsharma07 2y ago
They were only printed to stdout and not sent out
41.
by varunsharma07 2y ago
Great points! Harden-Runner ( https://github.com/step-security/harden-runner ) is similar to Firejail and OpenSnitch but purpose-built for CI/CD context. Harden-Runner detected this compromise due to an anomalous ou
42.
by varunsharma07 2y ago
Yes, just prints to the build log, so the risk is higher for public repos. Lot of public repos have creds printed in their build logs due to this compromised action.
43.
by varunsharma07 2y ago
https://github.com/tj-actions/changed-files/issues/2463
44.
Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos(stepsecurity.io)
273 points by varunsharma07 2y ago|298 comments
45.
by varunsharma07 2y ago
What Happened? • The compromised Action executes a Python script that dumps CI/CD secrets from the Runner Worker process. • Multiple v35 tags were modified four hours ago, indicating a recent supply chain attack. • The malicious behavi
46.
by varunsharma07 2y ago
An independent security researcher, on August 31st, 2024, demonstrated a successful supply chain attack on Azure Karpenter Provider, an open-source project maintained by Microsoft. A vulnerable GitHub Actions workflow led to this attack. Th
47.
CI/CD supply chain attack on Azure Karpenter Provider open-source project(stepsecurity.io)
3 points by varunsharma07 2y ago|2 comments
48.
Security Breach in Stripe Repo: A Deep Dive into the "Pwn Request" Vulnerability(stepsecurity.io)
7 points by varunsharma07 2y ago|0 comments
49.
An Obscure Actions Workflow Vulnerability in Google's Flank(adnanthekhan.com)
20 points by varunsharma07 3y ago|1 comments
50.
Show HN: GitHub Actions Advisor – View security scores of GitHub Actions you use(app.stepsecurity.io)
3 points by varunsharma07 3y ago|0 comments
51.
How Google secures their GitHub Actions workflows with StepSecurity(stepsecurity.io)
3 points by varunsharma07 3y ago|0 comments
52.
Protect Against CI/CD Attacks That Poison GitHub Actions Workflows(infosecwriteups.com)
3 points by varunsharma07 3y ago|0 comments
53.
Celebrating Success of 500 Open Source Projects Using StepSecurity's Platform(stepsecurity.io)
1 points by varunsharma07 3y ago|1 comments
54.
by varunsharma07 3y ago
You can browse the pull requests created by the top 50 of the 500 open-source projects that have benefited from the platform at app.stepsecurity.io/securerepo/trending.
55.
Show HN: AI-CodeWise – Transforming Code Reviews with AI-Powered Analysis(github.com)
2 points by varunsharma07 3y ago|0 comments
56.
Show HN: Secure your public GitHub repository with automated security fixes(github.com)
2 points by varunsharma07 4y ago|0 comments
57.
by varunsharma07 4y ago
I am hesitant about sharing QR codes etc., with a 3rd party. I assume I would have to share the QR code with you, right?
58.
by varunsharma07 4y ago
Can tests be created automatically based on captured API traffic? Also, I have heard a bit about, but not read in detail about Nuclei: https://nuclei.projectdiscovery.io/templating-guide/ . How does this compare with yo
59.
by varunsharma07 4y ago
Please see if you can add options for the feelings. It is easier to decide on a feeling when you see a list of options. It will also make aggregating easier.
60.
by varunsharma07 4y ago
Interesting. I have felt the need for this before. Do you also support authenticator app codes? I believe authenticator apps are recommended relative to SMS.

More ›