The attacker exploited a misconfigured GitHub Action called a Pwn Request vulnerability to steal privileged tokens and download the source…