We support the latest released minor version of each @better-i18n/* package.
Use GitHub Private Vulnerability Reporting on the affected repo:
Security → Report a vulnerability. We respond within 3 business days.
Please do not open a public issue for security-sensitive reports.
Every public Better-i18n repo runs the shared Security baseline workflow
(better-i18n/.github/.github/workflows/security-baseline.yml)
on every pull request and on pushes to main / development:
step-security/harden-runner(audit mode) — every outbound network call during the job is recorded. This is the tool that caught axios, tj-actions /changed-files (CVE-2025-30066), NX Build, Trivy v0.69.4, and Sha1-Hulud compromises in production CI runs.- PolinRider / Shai-Hulud / TasksJacker IOC scan — fails the build if any
known marker string (e.g.
rmcej%otb%,Cot%3t=shtP,global['_V'],_$_1e42,function MDy, TRON/Aptos C2 strings) or known artifact filename (setup_bun.js,bun_environment.js,cloud.json,actionsSecrets.json,temp_auto_push.bat,discussion.yaml) lands in the working tree. - SHA-pin enforcement — every GitHub Action reference must be a 40-char
commit SHA, never a tag. Tag references can be retargeted to a malicious
commit by the action owner (the tj-actions/changed-files /
v1retargeting is the textbook example).
Maintainers must configure the following rules on each repo's default branch
(main or development):
- Require a pull-request review with at least 1 approval from CODEOWNERS
- Require the
Security baseline / Supply-chain baselinestatus check to pass - Require conversation resolution before merging
- Require signed commits
- Require linear history
- Disallow force pushes and branch deletions
The supply-chain IOC list is sourced from OpenSourceMalware.com's
#polinrider and #sha1hulud campaign reports.