Get the latest tech news
Popular GitHub Action tj-actions/changed-files is compromised
Popular GitHub Action tj-actions/changed-files has been compromised with a payload that appears to attempt to dump secrets, impacting thousands of CI pipelines.
And if we find more information about what tags & commits are affected, we can update the rule over time to become more precise about whether or not you could be impacted. Prioritize repos where your CI runner logs are public, as secrets are dumped to stdout in the payload. About Semgrep lets security teams partner with developers and shift left organically, without introducing friction.
Or read this on Hacker News
