G
Jul 16, 2026GitHub Actions Supply Chain in 2026: tj-actions, Trivy, Bitwarden, and the Year the Bots Showed Up
From tj-actions/changed-files (CVE-2025-30066, 23,000 repos) to Trivy (hackerbot-claw, March 2026) to Bitwarden CLI (April 2026). Real cases, IOCs, the pull_request_target misconfiguration that ties them together, and detection rules CI/CD teams can
Jul 16, 20268 min read0 reactions0 comments

