@redhat-cloud-services publish pipeline is compromised today and shipped a signed, trusted, malicious npm package

← 피드로

[email protected] went out through the project's own github action OIDC trusted publisher today and not any stolen token or a typosquat anything, we saw that the actual release pipeline produced it. this runs on npm install, steals cloud creds and self propagates by injecting fake…

원문 보기 ↗