Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Summary The Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token GitHub PAT, GitLab token, etc. by...

MAL-2024-12303 Malicious code in maliciouspackage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0e8a8d581266436f0546b5039ee82ab734d45f8489e281322dd871124dad9ce Clearly a demo malicious package, attempting to exfiltrate a token from the git config --- Category: PROBABLYPENTEST - Packages looking like typical pentest...