TeamPCP - GitHub Actions PR Comment Interpolation

Ibrahim Saud@tektrix

•updated Jun 21, 2026•4•0•3

Detects malicious command injection where GitHub Actions interpolates ${{ github.event.comment.body }} directly into a bash run block, specifically looking for patterns associated with the 'curl.litter.catbox.moe..sh' domain.