The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave | Wiz Blog
Multi-ecosystem supply chain compromise by TeamPCP targets GitHub, NPM, and VSCode to steal credentials and establish persistence.
actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecurity
stepsecurity.ioThe popular GitHub Action actions-cool/issues-helper has been compromised. Every existing tag in the repository has been moved to point to a single imposter commit that does not appear in the action's normal commit history. That commit contains malicious code that exfiltrates credentials from CI/CD pipelines that run the action.
Finding Unpinned and Unpinnable GitHub Actions
How to identify unpinned and unpinnable GitHub actions across your organisation
Compromised GitHub Action Exfiltrates Workflow Credentials to Attacker Domain
Hackers hijacked the actions-cool GitHub Action, redirecting tags to malware that steals CI/CD credentials.