OPENING PANDORA’S BOX - SUPPLY CHAIN INSIDER THREATS IN OPEN SOURCE PROJECTS

Summary from the TLDR InfoSec newsletter

This article is about the risks of insider threats in open-source projects that use GitHub Actions. Users with write access to a repository can push and immediately delete malicious Git tags. This vulnerability can be mitigated by enabling Tag protection so that these commits don’t trigger malicious actions.