Attributed metadata history
Up to 100 retained publisher events per page for b1f745ca8d0a1405261a018f55e244cf7026f9b5544ff94dc7643e7f871ba3dd. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:04 UTC
A vulnerability in GitHub Actions allows bypassing workflow settings using commits from forked repositories (rather than commits of the main action repo). This "imposter commits" issue can potentially introduce untrusted code into CI/CD pipelines, posing a risk to the security of the software supply chain. The vulnerability stems from GitHub's handling of forked repositories and how commits are shared between forks and parent repositories. A partial solution to this was GitHub prohibiting partial commit references in workflows, however, no full solution exists currently.
Fingerprint: a09cf63dace72e28a8867b215f92668c37703db66df5f5b22e3eb33e04235a7b
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c