🎯 GitHub Actions workflow injection

The items that name it 2

• SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors
  writeup2026-10-05It is written here as GitHub Actions workflow injection (CI/CD poisoning).

  With a collected token, creates branch dependabot/github_actions/format/setup-formatter and adds .github/workflows/codeql_analysis.yml containing a 'Run Copilot' workflow that serializes toJSON(secrets) into format-results.txt, uploads it as an artifact, retrieves it, then attempts to delete the run

• Socket: Bitwarden CLI Compromised in Checkmarx Supply Chain Campaign
  writeup2026-05-06

  Injects GitHub Actions workflow YAML to capture repository secrets