More details have come to light on the recent supply chain attack targeting GitHub Actions, including its root cause.