The compromised action could impact thousands of CI pipelines, the report said. GitHub pulled access to the tool by March 16 and replaced it with a patched version.