Comment by ZeWaka

they probably used the publish token in a pull-request-target workflow or something?