Readit NewsThe attacker did not need to merge any PRs to exfiltrate the credentials
On an MBP, I'm using:
browser "open %u"
show-read-feeds no
auto-reload yes
reload-time 60
macro m mark-feed-read ; quit ; reload-all
macro k open ; goto-url 2 ; quit
"query:Unread Articles:unread = \"yes\""
Error: no URLs configured. Please fill the file ~/.newsboat/urls with RSS feed URLs or import an OPML file.
cf https://en.wikipedia.org/wiki/Operant_conditioning_chamber#/...
To any beginners reading this: Solving problems inefficiently does not make you a bad programmer. Most of the time, an "inefficient" solution will be good enough, and optimising for performance comes at a cost.
So sit back, relax, and enjoy the journey.
The attacker did not need to merge any PRs to exfiltrate the credentials
The workflow was configured in a way that allowed untrusted code from a branch controlled by the attacker to be executed in the context of a GitHub action workflow that had access to secrets.