10 replies

1. Pier Bluesky 14 min later

   The fact that they didn't use a more obvious name makes me think they didn't really consider the security implications.

   1. Zach Leatherman Bluesky 16 min later

      dangerously_pull_request_target_SUPER_INSECURE_WARNING_CAREFUL_WATCH_OUT

      1. Pier Bluesky 23 min later

         lol

2. Alex Grant Mastodon 21 min later

   @zachleat

   1. Zach Leatherman Mastodon 39 min later

      @localnerve I would prefer to live a very boring life when it comes to third party dependencies 😅

      1. Alex Grant Mastodon 1 hr later

         @zachleat

         But you're in GitHub Actions, an `evil_petting_zoo`
         (Same actor, different costume, pinky)

3. Matt Steele Mastodon 5 hr later

   @zachleat DO_NOT_USE_OR_YOU_WILL_BE_PHISHED

   1. Zach Leatherman Mastodon 23 hr later

      @mattdsteele look, if you’re ever offered phish concert tickets in an email — definitely click the link

4. Gabriel N Mastodon 23 hr later

   @zachleat I read the article about Shai Hulud 2.0 this morning and am still flabbergasted by its complexity.

   How are you supposed to protect your project against something like that?

   1. Zach Leatherman Mastodon 23 hr later

      @wtrmt fascinatingly enough I wrote up the steps I’ve taken 😅 https://www.zachleat.com/web/npm-security/