Fraudulent Dependabot commits leveraged for malicious code injection

Hundreds of GitHub repositories have been targeted with fraudulent commits purportedly from GitHub's free automated dependency management tool Dependabot in a bid to facilitate malicious code injections and exfiltrate sensitive project data exfiltration, reports SecurityWeek.

Article Link: Fraudulent Dependabot commits leveraged for malicious code injection | SC Media

1 post - 1 participant

Read full topic

article automated code code injection data data exfiltration dependabot dependency exfiltration fraudulent free github github repositories injection link malicious management media project reports repositories sensitive tool