Pretty nasty supply chain attack when using GitHub self-hosted runners.

Tony Meyer @tonyandrewmeyer