From The Register
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
'The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully'