url
https://webhook.site/710babde-6ace-47fe-83f4-9688e6548df9
discovered 2026-07-24
Dead-drop for CI secrets (PIPY_TOKEN, CODECOV_TOKEN) exfiltrated by the poisoned GitHub Actions workflow ci-mrmustard-check.yml at commit 80aba72. webhook.site is a legitimate request-inspection service abused as a dead drop; the unique token path is the indicator.
