Commit 48fc7c4
committed
chore: remove dead build scripts containing supply-chain vulnerability
Remove the entire .buildscript/ directory and release.sh — all dead code
from a legacy CircleCI/Bintray era with zero references from active CI.
e2e.sh downloaded and executed a remote script from the unowned rudderio
GitHub org via wget|bash, which exfiltrates system info to an attacker
endpoint. release.sh sent credentials to the defunct Bintray API whose
domain could be re-registered. deploy_snapshot.sh hardcoded rudderio as
the authorised deployer. The remaining files (cli.sh, bootstrap.sh,
settings.xml) were orphaned.
Also removes the commented-out settings.xml reference from pom.xml.
🔒 Scanned for secrets using gitleaks 8.28.01 parent 3b11c8c commit 48fc7c4
7 files changed
Lines changed: 0 additions & 91 deletions
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
337 | 337 | | |
338 | 338 | | |
339 | 339 | | |
340 | | - | |
341 | 340 | | |
342 | 341 | | |
343 | 342 | | |
| |||
This file was deleted.
0 commit comments