@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this:<p><a href="https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised" rel="nofollow">https://www.stepsecurity.io/blog/harden-runner-detection-tj-...</a>
We've recently released open-source tools that would have easily prevented this, before anything runs or added to any pipeline:<p>1. The maintainers could have used PRevent to immediately alert and block any PR containing malicious code, or easily configured it for detection in case of a direct push: <a href="https://github.com/apiiro/PRevent" rel="nofollow">https://github.com/apiiro/PRevent</a><p>2. Users could have used our malicious code detection ruleset to immediately detect and block it when scanning updates in all relevant CI/CD stages: <a href="https://github.com/apiiro/malicious-code-ruleset" rel="nofollow">https://github.com/apiiro/malicious-code-ruleset</a><p>3. For a better understanding of the detection, the malicious code falls precisely into the patterns presented in our research: <a href="https://apiiro.com/blog/guard-your-codebase-practical-steps-" rel="nofollow">https://apiiro.com/blog/guard-your-codebase-practical-steps-</a>...