GitHub Actions

A GitHub Comment Backdoored a Python Package. Read That Again.

An attacker posted a comment on a pull request. Twelve hours later, every data engineer running elementary-data 0.23.3 was exfiltrating their warehouse credentials to a stranger. Your CI/CD pipeline is a factory floor with no locks on the doors.