5 ms·
You can pin GitHub Actions to specific versions or specific commits. But note you can change version tags arbitrarily. In this specific case, the bad actor chan
by werrett 2y ago
You can pin GitHub Actions to specific versions or specific commits. But note you can change version tags arbitrarily. In this specific case, the bad actor changes all of the version tags to point to their malicious commit:
https://github.com/tj-actions/changed-files/tags https://github.com/tj-actions/changed-files/tags
So to avoid that you'd have to pin your GitHub Action to specific commits as outlined in this SO post:
https://stackoverflow.com/a/78905195 https://stackoverflow.com/a/78905195
- zahlman 2y ago> In this specific case, the bad actor changes all of the version tags to point to their malicious commit: https://github.com/tj-actions/changed-files/tags https://github.com/tj-actions/changed-files/tags This required compromising the entire repository, yes? It can't be explained as the maintainer being tricked into merging something malicious?
- ImPostingOnHN 2y agoThe repo looks like it uses itself in its workflows, so it's possible that the commit being merged resulted in the necessary credentials being leaked to the attacker.
- rognjen 2y agoThere doesn't seem to be a PR for the commit though.
- werrett 2y agoYes. It was probably a maintainer's creds being compromised. The [malicious commit is masquerading as a commit from Renovate](https://github.com/tj-actions/changed-files/commit/0e58ed8671d6b60d0890c21b07f8835ace038e67#diff-3d2b59189eeedc2d428ddd632e97658fe310f587f7cb63b01f9b98ffc11c0197R2999 https://github.com/tj-actions/changed-files/commit/0e58ed867...)((https://github.com/apps/renovate https://github.com/apps/renovate) but it's not a `verified` commit (and so it's trivial for a bad actor to masquerade as them). https://stackoverflow.com/questions/67609381/why-do-all-my-github-commits-show-as-unverified https://stackoverflow.com/questions/67609381/why-do-all-my-g...