discovered
Dead-drop for CI secrets (PIPY_TOKEN, CODECOV_TOKEN) exfiltrated by the poisoned GitHub Actions workflow ci-mrmustard-check.yml at commit 80aba72. webhook.site is a legitimate request-inspection service abused as a dead drop; the unique token path is the indicator.