Re-Enabled GitHub Actions Repos Trigger Malicious Code Re-Execution in CI Pipelines

·3 views

Two GitHub Actions repositories — actions-cool/issues-helper and actions-cool/maintain-one-comment — were re-enabled on September 16, 2026, weeks after being disabled following a supply chain attack discovered in May 2026. The repositories were restored while still carrying malicious tags from the original compromise, meaning no new attacker activity was needed to resume the threat. Security firm Socket confirmed through execution logs that workflows referencing issues-helper re-ran the malicious payload upon the repositories being restored. GitHub's dependency graph shows approximately 15,000 repositories relied on issues-helper, though this figure reflects potential exposure rather than confirmed cases of code execution or data theft. GitHub disabled both repositories again on September 25, 2026, after the renewed risk was identified.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

The Hidden Cron Scheduling Bugs That Catch Even Experienced Developers

Cron jobs, used to automate backend tasks like backups and health checks, follow a simple five-field syntax but hide subtle bugs that stem from differing implementations across platforms. A common production mistake involves combining day-of-month and day-of-week restrictions: in standard Unix cron, the expression '0 0 1 * 1' runs on both the 1st of every month and every Monday, not just Mondays that fall on the 1st. Extended syntax features like L, W, and # are supported in modern schedulers such as Quartz and Kubernetes but are silently ignored or treated as errors in classic Unix cron, causing jobs to never run without any warning. Cloud platforms including AWS EventBridge and GitHub Actions default to UTC, meaning a job scheduled for 9 AM may fire at an unintended local time for users in other time zones. Developers are advised to verify the target scheduler's syntax rules, timezone defaults, and day-field logic before deploying any cron expression.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

New tool countfn measures algorithm complexity by counting operations, not time

A developer has released countfn, available on both PyPI and npm, which measures algorithmic complexity by counting operations such as reads, writes, and calls rather than relying on elapsed execution time. Unlike existing tools such as big-O and big-o-calculator, countfn can return an 'UNDETERMINED' result instead of forcing a potentially incorrect complexity classification. Because operation counts are deterministic and noise-free, the tool avoids the statistical uncertainty inherent in timing-based measurements. The library also guarantees cross-language parity, meaning the same algorithm with the same seed produces identical operation counts in both Python and JavaScript. When complexity cannot be confidently identified — such as when two classes are too close to distinguish — countfn explicitly refuses to name one rather than guessing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Make vs Zapier for Freelancers: How to Choose the Right Automation Tool

Freelancers in 2026 broadly have two leading automation platforms to choose from — Zapier and Make — each suited to different working styles and needs. Zapier is recommended for those who want quick, straightforward setups with a guided experience and a large template library, while Make better serves users who need branching logic, bulk operations, and more cost-efficient handling of complex, high-volume workflows. Both platforms support thousands of app integrations and now include AI steps capable of summarizing or drafting text mid-flow. Pricing models differ significantly: Zapier charges per task and costs can rise quickly with multi-step automations, whereas Make's operations-based billing often proves cheaper for data-heavy or frequent workflows. Experts suggest freelancers prototype in Zapier for speed, then migrate demanding pipelines to Make once volume and complexity justify the switch.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

docs-governance Helps Preserve Project Context Across AI Coding Agent Sessions

A developer has released docs-governance, an MIT-licensed open-source tool designed to retain project decision context across AI coding-agent sessions in Claude Code and Codex. The tool uses a set of small, purpose-specific Markdown files — covering project rules, navigation notes, current status, and change logs — to give each new session structured context without overloading a single instruction file. It also includes reusable skills, templates, and audit scripts, with support for larger projects needing architecture documents and decision records. The project is available on GitHub with installation instructions for both Claude Code and Codex. The developer is seeking community feedback on whether the audit tooling surfaces useful issues and whether maintaining the files remains practical in real-world projects.

0 comments Read more at DEV Community