Loading story…
Xygeni disclosed suspicious activity affecting the repository used to publish its xygeni/xygeni-action GitHub Action, where an unidentified threat actor attempted to introduce a compact command-and-control (C2) implant. While malicious code was reportedly blocked from being merged into the main branch via branch protection/detection rules, the actor pivoted to tag poisoning by moving the mutable v5 tag to point to a malicious commit created during the pull-request attempts. As a result, any CI/CD workflows pinned to xygeni/xygeni-action@v5 could have pulled the compromised code without any visible change to workflow definitions; Xygeni removed the tag as part of incident response after community reports helped surface the issue.
Xygeni attributed initial access to compromised credentials tied to a maintainer token and a GitHub App installed on the repository, and stated it found no evidence that its broader platform or customer data was compromised. Wiz also tracked the incident as an action repository hijack, reinforcing the supply-chain risk of mutable tags in GitHub Actions and the need to pin actions to immutable commit SHAs or tightly controlled release tags.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
On March 11, 2026, Xygeni publicly stated that the incident was caused by compromise of a GitHub App private key with excessive permissions, used with a maintainer personal access token to create and approve pull requests. The company said it found no evidence of compromise to its platform or customer data, and announced mitigations including release immutability, tighter permissions, mandatory signed commits, reduced write access, and guidance for customers to pin safe SHAs, audit CI logs, and rotate secrets.
By March 10, 2026, community reports and StepSecurity analysis had identified that the Xygeni GitHub Action v5 tag was serving a malicious commit. Their findings helped establish the likely exposure window and the risk to CI environments.
Xygeni said it identified follow-on malicious activity on March 9, 2026, during the repository compromise. The company responded by removing the affected tag as part of incident containment.
Between March 3 and March 10, 2026, users running xygeni/xygeni-action@v5 may have executed a reverse-shell C2 implant on CI runners, potentially exposing GITHUB_TOKEN values, repository secrets, and source code. The compromise stemmed from tag poisoning rather than malicious code merged into the main branch.
An unidentified attacker compromised Xygeni’s official GitHub Action repository by poisoning the mutable v5 tag so workflows using xygeni/xygeni-action@v5 would resolve to a malicious commit. Reports indicate the malicious tag exposure lasted for up to seven days, beginning on March 3, 2026.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors compromised the popular GitHub Actions repositories `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` by moving version tags to imposter commits outside the normal commit history, causing workflows that referenced those tags to fetch and run malicious code. Researchers said the payload downloaded the **Bun** JavaScript runtime, read memory from the GitHub Actions `Runner.Worker` process to recover decrypted secrets, and exfiltrated the data over HTTPS to the attacker-controlled domain `t.m-kosche[.]com`; workflows pinned to a known-good full commit SHA were not affected. GitHub later disabled access to the repository for a terms-of-service violation, while StepSecurity added the action to its Compromised Actions Policy and blocked the exfiltration domain through Harden-Runner. The incident highlights a broader GitHub Actions supply-chain risk in which CI/CD trust can be subverted through mutable references and weak integrity controls. Separate research showed that a modified Maven wrapper in a pull request could achieve code execution on GitHub-hosted runners and, if merged, later expose release secrets such as Maven publishing credentials and GPG material, underscoring the need for checksum validation on wrapper scripts and immutable pinning to trusted commit SHAs for third-party actions. StepSecurity also linked the same exfiltration infrastructure to the recent **Mini Shai-Hulud** activity targeting npm packages in the `@antv` ecosystem, suggesting the GitHub Actions compromise may be part of a wider supply-chain campaign.
Jun 29, 2026
The popular GitHub Action **`tj-actions/changed-files`** was compromised in a software supply-chain attack that redirected multiple release tags to a malicious commit, **`0e58ed8671d6b60d0890c21b07f8835ace038e67`**, causing affected workflows to dump CI secrets into GitHub Actions logs. Early reporting indicated that all versions might be affected because tags in the repository had been moved to the attacker-controlled commit, prompting maintainers and defenders to urge organizations to immediately stop using the action, review workflow runs, and rotate any credentials that may have been exposed. GitHub later tracked the incident as **`CVE-2025-30066`**, and the project retagged releases and published **`v46.0.1`** with guidance to pin only to a known-safe immutable commit.
Jul 24, 2026The widely used GitHub Action **`tj-actions/changed-files`** was compromised after an attacker gained write access to the repository and retargeted release tags to a malicious orphaned commit, causing workflows pinned to tags rather than immutable SHAs to run attacker-controlled code. The backdoor downloaded and executed a remote payload that scraped decrypted GitHub Actions secrets from process memory and printed them into workflow logs, exposing repositories that executed the action and creating acute risk for public projects where logs were openly accessible. The incident was detected after anomalous outbound network activity was observed, and the maintainer removed the malicious changes soon afterward. Follow-on analysis found the blast radius was substantial because the action was referenced across roughly **23,000 repositories** and many workflows were not pinned to a full commit hash. GitGuardian reported that among workflows executed during the compromise window, hundreds showed signs of exploitation and **603 secrets** were exposed in logs, including temporary GitHub tokens, DockerHub credentials, AWS keys, GitHub personal access tokens, Jira tokens, and cloud.gov credentials. Organizations using the action were urged to review workflow runs from March 14 onward, delete affected logs, rotate any exposed credentials, audit dependencies and commits, and pin third-party GitHub Actions to full commit SHAs to reduce future supply-chain risk.
Jun 29, 2026