#github-actions

Wiki 5

• CI Runner Token Extraction Code on a CI runner reads the runner-process memory to extract OIDC tokens for direct registry use
• GitHub Actions Cache Poisoning Attacker-controlled job writes cache entries that production workflows later restore
• Open Source Security at Astral Astral's full supply chain security posture; CI/CD lockdown, Trusted Publishing, Sigstore, cooldowns
• Pwn Request Pattern GitHub's `pull_request_target` running fork-controlled code in the base repo's permission context
• TanStack npm Supply Chain Compromise — Postmortem How three known vulnerabilities chained into 84 malicious @tanstack/* npm publishes, and what stops the same chain