Their product includes a static code analysis tool you can run in ci/cd pipelines, triggered by the existence of some files in your repo. It's the entry point

Their product includes a static code analysis tool you can run in ci/cd pipelines, triggered by the existence of some files in your repo. It's the entry point for this exploit. Something the attacker abuses to get rights they shouldn't have. The victim doesn't have to use it at all.