@redhat-cloud-services publish pipeline is compromised today and shipped a signed, trusted, malicious npm package
[email protected] went out through the project's own github action OIDC trusted publisher today and not any stolen token or a typosquat anything, we saw that the actual release pipeline produced it. this runs on npm ins
📄
This source provides headlines only. Use the button below to read the complete article on the original site.
📰 Read the original article on r/programming
Originally published by r/programming. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.