A cascading supply chain attack on GitHub that ... as well as GitHub Action ecosystem issues like tag mutability and poor audit logging. Projects and repositories that used the compromised actions ...

A sophisticated and ongoing supply-chain attack operating ... and benevolent security personnel by infecting them with Trojanized versions of open source software from GitHub and NPM, researchers ...