{"id":286899,"date":"2024-07-28T11:00:46","date_gmt":"2024-07-28T11:00:46","guid":{"rendered":"https:\/\/www.techopedia.com\/?p=286899"},"modified":"2024-07-28T11:00:45","modified_gmt":"2024-07-28T11:00:45","slug":"is-github-dying-a-slow-death","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/is-github-dying-a-slow-death","title":{"rendered":"Is GitHub Dying a Slow Death?"},"content":{"rendered":"

GitHub<\/a>, the open-source<\/a> developers’ paradise, is no longer what it used to be. After years of increasing calls that attackers are leveraging the platform to distribute and sneak in malware<\/a>, a new report reached a shocking conclusion.<\/p>\n

The Legit Security<\/strong> report found that most GitHub Actions are not created by verified users<\/a>, are not maintained, have vulnerabilities<\/a>, and have very low-security scores.<\/p>\n

Roy Blit, Head of Research at Legit Security, spoke about the dangers that this represents for companies everywhere, in a press release<\/a>.<\/p>\n

“GitHub is an extremely popular platform. In fact, more than 100 million developers and over 90% of Fortune 100 companies use it.<\/p>\n

 <\/p>\n

“However, despite its popularity, most GitHub Actions workflows are insecure in some way \u2014 from being overly privileged to having high-risk dependencies.<\/p>\n

 <\/p>\n

“For instance, our past research found even projects from global enterprises like Google and Apache are flawed<\/strong>. These findings are alarming because GitHub Actions provide the key to critical infrastructure.<\/p>\n

 <\/p>\n

“They are connected to an organization’s source code and their deployment environment, so once exploited, the organization is completely in the attacker’s hands.”<\/p><\/blockquote>\n

\n

Key Takeaways<\/span><\/h2>\n