pwn-request
Pwn Request
What Is Broken and Why
A "Pwn Request" occurs when a pull_request_target workflow — which runs in the context
of the base repository with access to its secrets — explicitly checks out the PR
contributor's code and executes it (via npm install, make, build scripts, etc.).
pull_request_target was designed to safely access secrets for things like posting
comments on PRs from forks, but developers mistakenly combine it with a checkout of
the PR head SHA, collapsing the trust boundary. Any attacker who can open a PR can
now execute arbitrary code with the repository's GITHUB_TOKEN and all configured secrets.
The npm preinstall/postinstall lifecycle scripts are the most common execution vector —
they run automatically during npm install / npm ci with no additional flags required
unless --ignore-scripts is explicitly set.