Top all-time · #11301
Apiiro
Company blog · apiiro.com/blogsecurityai
Apiiro is the company blog at apiiro.com, writing about security and ai. Since 2022, 6 different Hacker News readers have linked it 7 times, most often “Over 100k Infected Repos Found on GitHub”. No feed was found, so read it on the site itself.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
Comments promote the company's open-source PRevent tool and malicious-code detection ruleset as ways to have blocked the tj-actions/changed-files compromise. No comment judges the writing itself.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Secure everything coding agents build, use, and ship - prevent risk before code exists, AutoFix the backlog, and protect the coding agents and supply chain.
Most-linked posts?
- Over 100k Infected Repos Found on GitHub2 people · 2 mentions · first linked 2024-02-28
- CVE-2022-24348: vulnerability in Argo CD can be used to steal sensitive info2 people · 2 mentions · first linked 2022-02-04
What Hacker News says?
We've recently released open-source tools that would have easily prevented this, before anything runs or added to any pipeline: 1. The maintainers could have used PRevent to immediately alert and block any PR containing malicious code, or easily configured it for detection in case of a direct push: https://github.com/apiiro/PRevent 2. Users could have used our malicious code detection ruleset to immediately detect a…
Comment linking /blog/guard-your-codebase-practical-steps-
on “Popular GitHub Action tj-actions/changed-files is compromised”Submitted Over 100k Infected Repos Found on GitHub as a story · 284 points
HN discussionWe've recently released open-source tools that would have easily prevented this: 1. The maintainers could have used PRevent to immediately alert and block any PR containing malicious code, or easily configured it for detection in case of a direct push: https://github.com/apiiro/PRevent 2. Users could have used our malicious code detection ruleset to immediately detect and block it when scanning updates in all releva…
Comment linking /blog/guard-your-codebase-practical-steps-and-tools-to-prevent-malicious-code/
on “Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos”Submitted CVE-2022-24348: vulnerability in Argo CD can be used to steal sensitive info as a story · 3 points
HN discussionSubmitted CVE-2026-82456: Argo CD MCP Server Kubernetes Takeover as a story · 2 points
HN discussionSubmitted Over 100k infected repos found on GitHub as a story · 1 points
HN discussionSubmitted Apiiro team uncovers 0-day vulnerability in Argo CD as a story · 1 points
HN discussion