Malicious code in @ibm-pipeline/logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39c2a2cdb3bc14845ecbf9b595e8481d32046cbce9bf164e9c4182145f51951a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @ibm-pipeline/logging

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SSH Agent Plugin could reveal SSH key passphrase when used inside pipeline

When using the sshagent step inside a withDockerContainer block in Pipeline, the resulting logging of the ssh-add command included the SSH key passphrase in plain text. The plugin no longer logs the ssh-add invocation that would reveal the passphrase...