GitHub Attack Vector Cracks Open Google, Microsoft, AWS Projects

Unit 42 researchers disclosed an attack vector that abuses GitHub Actions artifacts to expose ephemeral GitHub tokens and third-party cloud credentials from open-source project workflows. The leaked tokens could allow attackers with repository read access to push malicious code through CI/CD pipelines or access secrets, impacting numerous high-profile projects; affected maintainers were notified and mitigations were applied, though other projects may still be at risk.