Why wasn't this vulnerability fixed before the attack happened?
A contributor flagged the workflow weakness and proposed a fix on May 17, 2026, but per Wiz and Chainguard it sat unmerged for 58 days before the July 14 exploit. Microsoft's own timeline traces the underlying proof-of-concept even earlier, to April 29 — months of visibility before anyone acted on it.
Answered in
A Misconfigured GitHub Action Backdoored Packages With 3M Weekly DownloadsA pull_request_target flaw in AsyncAPI's CI let attackers steal a token and trojan 4 npm packages — 3M+ weekly downloads — with credential-stealing code.
Read the full analysisOther questions this article answers
More development best practices questions
- Why is a large-scale test framework migration usually so slow to do by hand?
- Why did retry loops with error feedback outperform carefully engineered prompts?
- When does a migration pipeline need rich prompt context instead of just retries?
- How do you migrate the last 3% of files that automation can't fully finish?
- Does this approach only work for test framework migrations?
- What is Project Polaris and how does it relate to GitHub Copilot?
- What architecture does Project Polaris use?
- How does Project Polaris perform compared to GPT-4 Turbo on coding benchmarks?
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Development Best Practices beat.