Node.js repository CI/CD vulnerable to RCE (Research)

A researcher discovered a critical vulnerability in the Node.js CI/CD workflow that allowed an attacker to forge Git commit timestamps to smuggle unreviewed malicious commits into Jenkins pipelines; the payload modified build scripts to install a rogue GitHub Actions runner, enabling persistent remote code execution on over a dozen Jenkins agents and exposing a substantial supply-chain and credential-exfiltration risk.