Everyone says pin your GitHub Actions to a SHA. I don't pin mine

In late 2025, a maintainer's npm account got compromised and a couple of extremely popular packages,...