Yes it is a GitHub actions cache poisoning attack