Learn
Plain-language guides from ReleaseLock on GitHub release swaps, moved tags, stolen tokens, and how to check that what you install is what was published. Newest first.
-
If GitHub re-enables a compromised Action, is it safe again?
In Sept 2026 GitHub re-enabled two compromised actions-cool Actions with tags still on the malware. Why a tag isn't a lock, and how SHA pinning fixes it.
-
GhostAction is still reusing stolen GitHub tokens: what that could mean for your releases
GhostAction's October waves failed, but the same stolen GitHub tokens kept working. What a leaked token could do to your releases, and how to close it.
-
The git tag was clean, the release wasn't: what the LiteLLM 1.107.0 compromise shows
LiteLLM 1.107.0 was built from a lookalike fork, signed by the real pipeline, then the history was cleaned. How to check that what you install matches the source.
-
What 2026's GitHub supply-chain incidents show about unlocked releases
OVHcloud's swapped CLI and a 61-repo GitHub issue campaign show two paths to release access. See which controls stop each step and check your tools.
-
Can this GitHub release be swapped?
A checksum file is not swap-proof. How GitHub release asset swaps work, what the OVHcloud CLI incident showed, and how to check whether a specific tool is still swappable.