Hi, today in the morning I got email notifications about pull requests on some old on-template (non-nf-core) pipelines. The PRs come from bot accounts created in April. They did nothing relevant in case of Nextflow repos, but I saw them opening PRs that look malicious on the face in JS-based projects. Upon investigation, I found that they are most likely linked to Nils Reichardt, a cybersecurity researcher from TUM, and this project where he tests repositories for CI workflow vulnerabilities. I am mostly sharing this to alert you that his bots might eventually touch nf-core repositories (including the website). From what I've seen, Nils is a good hacker and reports the vulnerabilities he finds the correct way, but it might nonetheless be a good idea to double-check that our CI is robust to this type of exploit.

Could you link the PRs in question please?

PRs in my repos: https://github.com/itrujnara/get_kmers/pull/1 https://github.com/itrujnara/getgenomes/pull/1 https://github.com/itrujnara/featureextractor/pull/1 Example of a PR where the bot actually worked: https://github.com/wdrx70xn/win11React/pull/1 To his credit, most of the PRs seem to target forks of forks, but my (secret-free) repos were still touched