Featured
pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain
Executive summary We have managed to successfully compromise repositories owned by Microsoft, Google, Nvidia and many more using a single pull request from a fork. Based on our data, we believe the problem likely extends to many thousands of repositories that remain at risk of exploitation. These research discoveries have prevented far-reaching risks associated with …
