www.thelancet.com/journals/lan...

“20–40% of symptomatic people can manifest influenza-like illness (fever and cough or sore throat), whereas up to half of people with symptomatic illnesses can experience acute upper-respiratory-tract symptoms without fever, and the asymptomatic proportion can range from 14% to more than 50%”

It’s a commonly held bit of folk wisdom that if you have influenza you’ll know it - that “the flu” is always bad and “a cold” is not.

This is wrong! It can be mild or asymptomatic.

People think they can diagnose which virus they have from how they feel - vibe medicine!

It takes a test to know.

An issue we're seeing at all levels of university is that many students are simply refusing to do *anything*. They aren't reading the syllabus, aren't following assignment guidelines, aren't engaging with material, ignoring deadlines. And this might seem like old news, but it truly has ramped up.

in light of the current supply chain attacks, I've just published a @github.com action to detect packages that _lose_ their provenance.

📦 supports pnpm-lock.yaml, package-lock.json, yarn.lock (v1)
🎨 inline GitHub annotations
✅ JSON output + configurable
💪 published in TS with zero deps

I wrote a script to show the exact commit versions of Actions used in your workflows on GitHub Actions.

Useful for stuff like the tj-actions/changed-files and reviewdog compromises.

github.com/github/audit...

#DevSecOps #SupplyChainSecurity #Actions #CiCd #GitHub #TJActions #ReviewDog

🔍 use GitHub Code Search to find uses of the Action: github.com/search?q=%2F...

👀 in your Dependency Insights for evidence of using the Action

🛡️ Try SAST such as CodeQL to look for unpinned Actions. For CodeQL you can do it with the security-extended suite and the actions/unpinned-tag query (I wrote the first version 😊): github.com/github/codeq...

Guess which Action I used as an example in the README. Yep, you guessed it... 🔮

What to do?

🚨 Security response. Check your logs, rotate and revoke credentials, etc.

📌 Make sure you're using pinned commits to 3rd party Actions. Pinning to a tag name is not enough 🙅‍♂️ to avoid this.

⚠️ Read the StepSecurity advisory (they detected it): www.stepsecurity.io/blog/harden-...

The malware has been given CVE-2025-30066, github.com/advisories/G..., with Dependabot alerts 🔔 being generated.

The repo is back under the maintainer’s control.

There was malware ☣️ in all tags for the GitHub Action 
 tj-actions/changed-files (2k stars ⭐️, 23k dependents)

Every tag 🏷️ was updated to a commit that injected malware

It dumped memory to search for secrets, to dump to logs - this will have most affected public repos

#Actions #AppSec #Malware

What to do?

🚨 security response. Logs, rotate/revoke secrets, etc.

📌 Pin your commits

🔎 Search for uses with GitHub Code Search, e.g.
github.com/search?q=%2F...

👀 Look in Dependency Insights for uses of these reviewdog Actions

It was discovered by Adnan Khan and posted on X

Malicious commit: github.com/reviewdog/ac...

Hash: f0d342d24037bb11d26b9bd8496e0808ba32e9ec

⚠️ Another GitHub Action was hacked ☣️, reviewdog/action-setup v1, again leaking secrets in workflow logs

Wiz is reporting that it was used in the hack of tj-actions/changed-files, and that other Actions under reviewdog were also affected

#SupplyChain #GitHubActions #AppSec #Malware #ReviewDog