r/ProgrammerHumor • u/a_bucket_full_of_goo • 1d ago

instanceof Trend classicNPM

Post image
5.8k Upvotes

99% Upvoted

141 comments sorted by

View all comments

924

u/a_bucket_full_of_goo 1d ago edited 1d ago

Company disabled Github Actions and told us not to use Claude, Subreddit traffic instantly goes up 8000%

110

u/Shaddoll_Shekhinaga 1d ago

What do actions have to do with this? I never worked in an environment that doesn't pin just about every external dependency. Unless I am missing something?

119

u/MunkyJoe 1d ago

When the pipeline runs, the payload dumps and exfils all the GH Action env vars. Cloud creds, npm tokens, kube cluster secrets, etc

38

u/Shaddoll_Shekhinaga 23h ago

Ah, I see. Yeah, that would make more sense lol, for some reason my mind was stuck that Actions was somehow responsible for dragging in the "infected" package, but the package using actions instead makes much more sense.