Don't use github actions. Don't use toolchains that auto execute stuff. Simple as that, because that's the attack surface. https://cookie.engineer/weblog/arti

Don't use github actions. Don't use toolchains that auto execute stuff. Simple as that, because that's the attack surface. https://cookie.engineer/weblog/articles/malware-insights-github-actions-script-injection.html https://cookie.engineer/weblog/articles/malware-insights-git... I wrote that article December 2024. Still ongoing, Microsoft. Best enterprise security practices, I suppose shrugs ...