GitHub Actions is a trap

Hackers are pwning packages at an exhausting clip, and GitHub Actions features in every postmortem. In late February, a hackerbot AI 1 yoinked the release key for a single project. Within a month, fifty-ish other projects had cred stealers. Each infected repo swiped credentials for the next. This spate of supply-chain hacks started from a GitHub Actions trap; a simple, bad default with a…