●builderIf your CI/CD pipeline or AI coding assistant pulls context from GitHub repos or Actions artifacts, you are a potential target — audit orphan-commit references and restrict OIDC token scopes immediately.
●policyThis is a concrete, weaponized supply chain attack vector targeting AI tool integrations specifically, which may accelerate calls for stricter provenance requirements on AI coding assistant data sources.