Slow Mist Cosine: Coinbase has been attacked by the GitHub Actions CI/CD mechanism supply chain, and it is recommended that companies check their own risks

On March 23rd, Slow Mist founder Cosine posted on social media, "Using the GitHub Actions CI/CD mechanism to attack Coinbase in the supply chain, fortunately it did not continue to succeed, otherwise the next security incident to be exposed would be against Coinbase. Supply chain attack path on GitHub: reviewdog/action-settings - > tj-actions/changed-files - > coinbase/agentkit - > steal GitHub personal access tokens (PAT), Cloud as a Service related keys, etc. Cosine suggests that if enterprises use reviewdog or tj-actions, they should conduct self-examination."