> The attack methodology involved a particularly sophisticated approach. Attackers inserted a base64-encoded payload into an install script

I don’t think obfuscating malicious code by encoding it as base64 is "particularly sophisticated". They mentioned that in my graduate program.

SimpleStacker

security

CISA confirms cascading attack from reviewdog to tj-actions exposed sensitive credentials across 23,000+ repositories.

A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have originated from an earlier breach of the “reviewdog/action-setup@v1” GitHub Action, according to a report.