Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour

'The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully'

Preview courtesy of The Register. The full article opens on their site.