another day, another ai supply chain backdoor.

[viss@mastodon.social]

another day, another ai supply chain backdoor.

or, several hundred of em, anyway.

[viss@mastodon.social]

id never considered pulling the ram out of the runner like that. when i steal github secrets its always through bad permisions on workflows but id shell the runner cuz its all env vars. super easy.
get shell
env
recieve bacon

[lando@infosec.town]

@Viss >=1 counts as “another”

[r0k@mastodon.social]

@Viss npm working as expected

[sharkfie@infosec.exchange]

@Viss was this because of a self hosted runner that wasn't isolating builds correctly? I'm confused