PR sneaking

Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows

GitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts

Why npm lockfiles can be a security blindspot for injecting malicious modules

Malicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly

Remove evidence of malicious pull requests on GitHub

Changing account's email to block-listed domain, automatically bans the account

GitHub comments abused to push malware via Microsoft repo URLs

Hidden GitHub comment link