The stolen PAT had write access to 'reviewdog/action-setup,' allowing the attacker to override the v1 tag with a malicious commit from a fork, poisoning all consumers of v1.

GitHub Actions are continuous integration and continuous delivery (CI/CD) frameworks designed to streamline the building, testing and deployment of code. A spokesperson at StepSecurity commented: “In ...

Researchers at Wiz Threat Research also said that, as recommended by GitHub, developers should pin all GitHub Actions to specific commit hashes instead of version tags to mitigate against future ...