Post #2869147

@verbrecher@mastodon.social @claushoumann@mastodon.social you forgot to add: registers the host as a GitHub action runner to remote control it through a malicious workflow containing a voluntary injection vulnerability. Yeah, that's thing really is friendly.