Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
EXCLUSIVE Researchers identified at least 83 attacks against 61 public GitHub repositories, including popular open source projects such as Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens.
Summary from The Register Security.