Fran Donoso
@francisck.com
I'm an infosec person who currently works as the CTO of a security services firm. Have done DevSecOps, Red Teaming, and reverse engineering. I reversed some of the tooling leaked by the Shadow Brokers and spoke about it publicly
November 1, 2025 at 2:34 AM
Okay 3rd (and last post) someone in the linked GitHub issue noticed that all of the tags in the project have been pointed to the malicious commit.
The malicious commit was made by a "renovate" bot - perhaps its creds were compromised?
3/2
github.com/tj-actions/c...
The malicious commit was made by a "renovate" bot - perhaps its creds were compromised?
3/2
github.com/tj-actions/c...
March 15, 2025 at 3:10 AM
Okay 3rd (and last post) someone in the linked GitHub issue noticed that all of the tags in the project have been pointed to the malicious commit.
The malicious commit was made by a "renovate" bot - perhaps its creds were compromised?
3/2
github.com/tj-actions/c...
The malicious commit was made by a "renovate" bot - perhaps its creds were compromised?
3/2
github.com/tj-actions/c...
Image referenced above is attached to this post.
The GitHub action ultimately outputs a double base64 encoded value that is the secrets it was able to extract.
See the second image for what this output looks like in Github action logs (I blacked out some of the output).
2/2
The GitHub action ultimately outputs a double base64 encoded value that is the secrets it was able to extract.
See the second image for what this output looks like in Github action logs (I blacked out some of the output).
2/2
March 15, 2025 at 3:08 AM
Image referenced above is attached to this post.
The GitHub action ultimately outputs a double base64 encoded value that is the secrets it was able to extract.
See the second image for what this output looks like in Github action logs (I blacked out some of the output).
2/2
The GitHub action ultimately outputs a double base64 encoded value that is the secrets it was able to extract.
See the second image for what this output looks like in Github action logs (I blacked out some of the output).
2/2
The judge: Why was your cat already wearing a hacker hoodie?!?
October 11, 2023 at 4:31 AM
The judge: Why was your cat already wearing a hacker hoodie?!?
Search for drinks in you camera roll
October 6, 2023 at 2:35 PM
Search for drinks in you camera roll