Developer Tech

GitHub adds approval checks for suspicious Actions workflows

GitHub Actions will hold potentially malicious workflows until a collaborator with write access approves them.

GitHub Automatically Holds Suspicious Actions Runs, but Repository Owners Must Approve Them

GitHub now automatically holds suspicious Actions workflows in public repositories, but maintainers must still review ...
CSOonline

GitHub Actions attack renders even security-aware orgs vulnerable

Many open-source repositories contain privileged GitHub Actions workflows that execute untrusted code and can be triggered by attackers to expose credentials and access tokens, as MITRE and Splunk ...
Redmond Magazine

Supply Chain Attack Hits Microsoft GitHub Repos, AI Coding Tools

GitHub disabled 73 Microsoft repositories after a Miasma supply chain attack. Malicious commits targeted AI coding tools, VS Code, and developer workstations. Developers should rotate credentials if ...