Why wasn't this vulnerability fixed before the attack happened?
A contributor flagged the workflow weakness and proposed a fix on May 17, 2026, but per Wiz and Chainguard it sat unmerged for 58 days before the July 14 exploit. Microsoft's own timeline traces the underlying proof-of-concept even earlier, to April 29 — months of visibility before anyone acted on it.
Answered in
A Misconfigured GitHub Action Backdoored Packages With 3M Weekly DownloadsA pull_request_target flaw in AsyncAPI's CI let attackers steal a token and trojan 4 npm packages — 3M+ weekly downloads — with credential-stealing code.
Read the full analysisOther questions this article answers
More development best practices questions
- What did OpenAI’s Habitat team change?
- Does the reported 12× read improvement mean another team should copy the design?
- Does the Python Typing Survey measure all Python developers?
- Do Python type hints enforce types at runtime?
- What is interactive refactoring in gopls?
- Is interactive refactoring already part of the official LSP standard?
- What does Meta mean by human-on-the-loop software engineering?
- Does Meta's Forum project prove that AI can replace a software team?
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Development Best Practices beat.