Skip to content

threat-intel: 6 MCP/AI-relevant OSV-confirmed malicious package(s) for review #362

threat-intel: 6 MCP/AI-relevant OSV-confirmed malicious package(s) for review

threat-intel: 6 MCP/AI-relevant OSV-confirmed malicious package(s) for review #362

Triggered via pull request July 17, 2026 11:38
Status Success
Total duration 3m 25s
Artifacts 3

ci.yml

on: pull_request
Prepare Source Tree
8s
Prepare Source Tree
ToolTrust Self-Scan
44s
ToolTrust Self-Scan
Fit to window
Zoom out
Zoom in

Annotations

8 warnings
Prepare Source Tree
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Verify Install Guide
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/setup-go@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Lint
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/setup-go@v5, golangci/golangci-lint-action@v7. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Verify Install (Homebrew)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Verify Install (Homebrew)
The following taps are not trusted: aws/tap Homebrew is currently ignoring formulae, casks and commands from these taps because tap trust is required. Untap them with: brew untap aws/tap Trust specific formulae, casks and commands with: brew trust --formula <user>/<tap>/<formula> brew trust --cask <user>/<tap>/<cask> brew trust --command <user>/<tap>/<command> Whole-tap trust is broader and includes all current and future formulae, casks and commands from the listed taps. Trust whole taps with: brew trust aws/tap To disable trust checks: export HOMEBREW_NO_REQUIRE_TAP_TRUST=1 This is not recommended and will be removed in a later release. For more information, see: https://docs.brew.sh/Tap-Trust
Test
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/setup-go@v5, actions/upload-artifact@v4, codecov/codecov-action@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Build
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/setup-go@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
ToolTrust Self-Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/setup-go@v5, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
coverage-report Expired
11.1 KB
sha256:b9e4d70b901222dc4a615ac4aaa736e1458d69c7f630fde079bb6e28ee075319
source-tree Expired
9.69 MB
sha256:c0e9ea0507608a2c111e3ac91e01c3c613c9b76f6578a92cc78823832a91d521
tooltrust-scanner-scan-report
1.37 KB
sha256:dc37d846359dd7a900ad6d51b35eacb92080b9e2431c78adfa65f7cffbff165c