Starting June 18, 2026, actions/checkout v7 will refuse to fetch code from forked pull requests in pull_request_target and workflow_run events by default, blocking common pwn request attack patterns. This update prevents untrusted fork code from running with full workflow privileges, and applies to all maintained versions by July 16, 2026, unless the “allow-unsafe-pr-checkout” flag is set.

• Starting June 18, 2026, actions/checkout v7 blocks fetching forked PR code in pull_request_target/workflow_run by default, requiring an explicit "allow-unsafe-pr-checkout" opt-in; full rollout across maintained versions completes by July 16, 2026.
• This directly targets "pwn request" attacks where a malicious fork PR exploits pull_request_target's full GITHUB_TOKEN access and secrets to steal credentials or push malicious code.
• Real-world incidents like the s1ngularity Nx package hijack and attacks on PostHog, TanStack, and kubernetes-el prompted the fix.
• The fix only closes the actions/checkout vector—untrusted code can still slip in via git, GitHub CLI, or other triggers, so teams still need to minimize pull_request_target use, restrict permissions, and validate inputs.

Over the past 15 months a series of high-profile backdoors, worms and trojans have compromised thousands of npm, PyPI and other open-source packages, exposing millions of downstream projects to remote access, data wiping and credential theft. The article traces incidents from the xz-utils backdoor to self-propagating npm worms, explains how deep dependency trees magnify risk, and outlines immediate steps—pinning versions, auditing dependencies and funding maintainers—to stem the threat.

• The Jia Tan xz-utils backdoor took two years of patient, legitimate-looking contributions to slip in, and was only caught by accident when an engineer noticed a slight SSH slowdown.
• Supply-chain attacks have escalated fast: Shai-Hulud went from hijacking 500 npm packages to infecting 25,000 GitHub repos two months later, complete with a dead-man's-switch data wiper.
• Nation-state actors are now directly involved—North Korea's Sapphire Sleet poisoned Axios (70M weekly downloads) with a RAT, and 1,700 malicious packages across npm, PyPI, Go and Rust have been tied to North Korean groups.
• A typical Node.js app pulls in 800–1,500 transitive dependencies (vs. 40 direct ones), meaning most compromises hit projects three or four layers deep where developers have zero visibility.

The article discusses a recent supply chain attack involving the popular Axios package, highlighting how an attacker installed malware without altering the original code. It emphasizes the challenges posed by AI in both coding and attacking, as automated systems can easily introduce vulnerabilities faster than traditional security measures can respond.

• Attackers hijacked a maintainer account and slipped a self-deleting RAT into Axios (100M+ weekly downloads) via a malicious dependency, leaving no CVE for traditional scanners to catch.
• AI coding agents are 50% more likely than humans to pick known-vulnerable dependencies and often hallucinate package names that attackers exploit via "slopsquatting."
• Attacks have shifted from targeting single packages to automated, ecosystem-wide worms, like the TeamPCP campaign that spread through 66 npm packages in days.
• Socket detected the malicious Axios dependency in 6 minutes by analyzing code behavior, versus the industry-average 267 days for breach detection.