corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a0b5ca-2149-71cb-97e0-2e36af85ff03

What the fork? Imposter commits in GitHub Actions and CI/CD

Chainguard Blog · published 8 March 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at chainguard.dev Wayback capture
5blogs citing
First cited
3 Feb 2026
Most recent
8 Apr 2026
Rank this month
not ranked
Links from this post
24
Words captured
1,607

Cited by

Blog
In the post
Date
astral.sh
Open source security at Astral Read at the source ↗
8 Apr 2026
vaines.org
The Comforting Lie Of SHA Pinning Read at the source ↗
24 Mar 2026
Datadog Engineering
When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos Read at the source ↗
9 Mar 2026
adnanthekhan.com
Turning Almost Nothing into a Supply Chain Compromise of Angular with GitHub Actions Cache Poisoning Read at the source ↗
3 Mar 2026
blog.ulisesgascon.com
Secure npm package publishing in 2026: A Complete Guide Read at the source ↗
3 Feb 2026

Links from this post

Link
Host
https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository
docs.github.com
https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/
orangematter.solarwinds.com
https://about.codecov.io/security-update/
about.codecov.io
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/about-forks
docs.github.com
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally
docs.github.com
https://github.blog/2015-09-22-counting-objects/
github.blog
https://github.com/github/dmca/commit/565ece486c7c1652754d7b6d2b5ed9cb4097f9d5
github.com
https://arstechnica.com/information-technology/2020/11/githubs-source-code-was-leaked-on-github-last-night-sort-of/
arstechnica.com
https://news.ycombinator.com/item
news.ycombinator.com
https://bounty.github.com/ineligible.html
bounty.github.com
https://github.com/ossf/scorecard/blob/main/docs/checks.md
github.com
https://github.com/actions/checkout
github.com
https://github.com/actions/checkout/commit/c7d749a2d57b4b375d1ebcd17cfbfb60c676f18e
github.com
https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
medium.com
https://github.blog/changelog/2021-01-21-github-actions-short-sha-deprecation/
github.blog
https://github.com/chainguard-dev/clank
github.com
https://github.com/ossf/scorecard
github.com
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
docs.github.com
https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification
docs.github.com
https://github.com/sigstore/gitsign
github.com
https://bounty.github.com/
bounty.github.com
https://www.hackerone.com/disclosure-guidelines
hackerone.com
https://github.com/github/roadmap/issues/592
github.com
https://www.chainguard.dev/assessment
chainguard.dev