Skip to content
Security

threat-intel: 6 MCP/AI-relevant OSV-confirmed malicious package(s) for review #385

Sign in to view logs

threat-intel: 6 MCP/AI-relevant OSV-confirmed malicious package(s) for review

threat-intel: 6 MCP/AI-relevant OSV-confirmed malicious package(s) for review #385

Triggered via pull request July 17, 2026 21:25
@brian93512brian93512
synchronize #90
ioc-candidates/29577479430
Status Success
Total duration 1m 50s
Artifacts 2

security.yml

on: pull_request
Prepare Source Tree
34s
Prepare Source Tree
Go Vulnerability Check
24s
Go Vulnerability Check
GoSec Static Analysis
1m 9s
GoSec Static Analysis
Dependency Review
5s
Dependency Review
ToolTrust Meta-Scan
35s
ToolTrust Meta-Scan
Fit to window
Zoom out
Zoom in

Annotations

6 warnings
Prepare Source Tree
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Dependency Review
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/dependency-review-action@v4, actions/download-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Go Vulnerability Check
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/setup-go@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
ToolTrust Meta-Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/setup-go@v5, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
GoSec Static Analysis
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/setup-go@v5, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
GoSec Static Analysis
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/

Artifacts

Produced during runtime
Name Size Digest
meta-scan-report
1.36 KB
sha256:9be8d248e7e698c5b1d89103e43c30bfb97947f110b0c76b09259c48b6a0bf5e
source-tree Expired
9.69 MB
sha256:5030a60e454a8c62df19e9f9e4e02537908062845c9d265d2cab2891a1bcead3