Project
Widely used GitHub Action reported as compromised in March 2025, leaking secrets into build logs of repositories that referenced it by tag.
GhostAction attackers used roughly 1,900 hijacked GitHub accounts to plant credential-stealing workflows in over 30,000 repos. No GitHub Actions flaw was involved, so defence means rotating exposed keys and reviewing who edits workflows.
Reality
SHA pinning drew a clean line through the tj-actions compromise, and then Dependabot began bumping hashes faster than anyone could read them. The claim worth enforcing is the version comment that nothing verifies.
Reality
GitHub's workflow execution protections went generally available on September 17, and the evaluate mode that shows what a rule would block before enforcement is documented as an Enterprise Cloud capability.
Reality
TanStack's postmortem says 84 malicious versions went out across 42 packages on 2026-05-11 with no npm token stolen, because a release job restored a cache that an untrusted pull_request_target build had written.
Reality
Codecov in 2021 and tj-actions/changed-files in March 2025 failed the same way: trusted third-party code running with pipeline privileges on a push nobody on your team made.
Reality