Yes, it is definitely dangerous, like any other code running next to your stuff. The thing you remember is probably this: https://www.cisa.gov/news-events/aler

Yes, it is definitely dangerous, like any other code running next to your stuff. The thing you remember is probably this: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-github-action-cve-2025-30066 https://www.cisa.gov/news-events/alerts/2025/03/18/supply-ch... and a larger description: https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 https://www.wiz.io/blog/github-action-tj-actions-changed-fil... I will be stunned if this doesn't become a more popular attack vector over the next few years. Lots of valuable stuff sits in github, and they're a nearly-wide-open hole to access it.