- 263comments
- 250comments
- 44comments
- 5comments
- 68comments
- 271comments
- 54comments
- 58comments
- 78comments
- 12comments
- 61comments
- 246comments
- 182comments
- 15comments
- 5comments
- 177comments
- 19comments
- 25comments
- 4comments
- 54comments
- 201comments
- 5comments
- 91comments
- 40comments
- 1comments
- 16comments
- 186comments
- 3comments
- 152comments
- —discuss
@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this:
https://www.stepsecurity.io/blog/harden-runner-detection-tj-...
Yeah maybe we can merge with https://news.ycombinator.com/item?id=43367987
Comments moved thither. Thanks!
We've recently released open-source tools that would have easily prevented this, before anything runs or added to any pipeline:
1. The maintainers could have used PRevent to immediately alert and block any PR containing malicious code, or easily configured it for detection in case of a direct push: https://github.com/apiiro/PRevent
2. Users could have used our malicious code detection ruleset to immediately detect and block it when scanning updates in all relevant CI/CD stages: https://github.com/apiiro/malicious-code-ruleset
3. For a better understanding of the detection, the malicious code falls precisely into the patterns presented in our research: https://apiiro.com/blog/guard-your-codebase-practical-steps-...