Security
How to Check Your Repos for the GhostAction Workflow and Lock Down Actions
A fake security-audit workflow is stealing secrets from GitHub repositories. Here are the searches, the cleanup order, and the settings that stop it.
#supply chain security
2 articles2 articles on Backtrace tagged "supply chain security."
2 articles
-
-
Securitynpm SlugFest Explained: How Trusted Publishing Let Attackers Hijack 1,500 Packages
A naming flaw in npm Trusted Publishing exposed more than 1,500 packages to takeover with no stolen credentials. Here is how SlugFest worked and what to audit now.