Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This amuses me:

> But Lewis Ardern on our team wrote a Semgrep rule to find usages of tj-actions, which you can run locally (without sending code to the cloud) via: semgrep --config r/10Uz5qo/semgrep.tj-actions-compromised.

So "remote code you download from a repo automatically and run locally has been compromised, here run this remote code you download from a repo automatically and run locally to find it"



A semgrep rule is not code; it does not run anything.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: