/css/ - CSS Masters

just saw a breakdown of how that 2021 incident happened and it's terrifying how easy it was. attackers only needed to add one line to a bash script to compromise everything because every ci job is basically an unsupervised computer with ur secrets. we are all just one bad dependency away from disaster is anyone actually auditing their pipeline scripts regularly?

more here: https://dev.to/leobaniak/the-codecov-bash-uploader-is-five-years-old-and-the-class-of-attack-still-lives-in-your-pipeline-33ng