xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning

A supply chain attack on the official xygeni-action GitHub Action allowed an attacker with stolen maintainer credentials to inject a C2 reverse shell backdoor via tag poisoning, silently compromising all workflows referencing the mutable @v5 tag and highlighting the urgent need to pin actions to immutable commit SHAs.