Supply chain
AllSupply chain
After tj-actions: keeping secrets safe in GitHub Actions
The tj-actions/changed-files compromise leaked CI secrets from logs. What happened, a tested check for unpinned actions, and layers that limit what a bad action can take.
An npm package you use was compromised: the first-hour playbook
What to do in the first hour after a malicious npm release like Shai-Hulud: check exposure, contain, rotate in the right order, and shrink the next blast radius.
Why can a postinstall script read your production secret?
Every npm worm steals the same thing: the credentials already in the install environment. A tested demo, the four layers that cut the loot, and what each one can't do.