kubernetes-el Compromised: How a Pwn Request Exploited a Popular Emacs Package

On March 5, 2026, a threat actor exploited a Pwn Request vulnerability in the CI workflow of kubernetes-el, a popular Emacs package for Kubernetes management. The attack resulted in theft of GITHUB_TOKEN with full write permissions, exfiltration of CI/CD secrets, repository defacement, and injection of destructive code. This supply chain attack demonstrates the risks of unsecured CI/CD workflows in open source projects.