Slow Mist Cosine: Coinbase Becomes Target of GitHub Actions CI/CD Mechanism Supply Chain Attack, Fortunately Failed

Odaily Planet Daily News: SlowMist Cosine published an article on X platform stating that it used GitHub Actions CI/CD mechanism to attack Coinbase's supply chain. Fortunately, it did not continue to succeed, otherwise the next security incident to be exposed would have targeted Coinbase. The supply chain attack path on GitHub: reviewdog/action setup ->tj actions/changed files ->coinbase/agentkit ->stealing GitHub Personal Access Token (PAT), cloud service related keys, etc. Cosine suggests that if a company uses review dogs or tj actions, it should conduct self inspection.