Loading story…
Palo Alto Networks demonstrated how a compromised GitHub Action could become a self-propagating software supply-chain worm by traversing the GitHub Actions dependency tree. A malicious action can access workflow-runner secrets—including automatically issued GITHUB_TOKEN credentials—and use writable branches, mutable tags, or overly permissive personal access tokens to alter repositories that consume or maintain dependent actions. The researchers identified repojacking as a viable initial-access route and disclosed an example chain involving papeloto/action-zip, Veracode, and Hangfire.
The scenario highlights OWASP's CICD-SEC-05 risk of insufficient pipeline-based access controls (PBAC): CI/CD identities and workflows must receive only the permissions required for a specific job. Organizations should minimize GITHUB_TOKEN and PAT scopes, protect branches and release tags, pin third-party actions to immutable commit SHAs, restrict runner outbound network access, and review dependency relationships and secret exposure in workflows to prevent a compromised action from modifying downstream repositories.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
A closed demonstration showed a compromised rev-action propagating through rev-date-action and random-action, then leaking the VERY_SECRET secret from the-repo after an overwritten v1 tag was consumed.
Hangfire remediated its finding by deleting all workflow files that used the affected actions.
Veracode remediated its finding by replacing the vulnerable third-party action with custom Bash commands.
Researchers reported identified GitHub Actions dependency-chain issues to vulnerable projects they were able to contact, including a chain involving papeloto/action-zip, Veracode, and Hangfire.
Researchers registered the available papeloto organization name to prevent malicious exploitation of the action-zip repojacking condition.
The papeloto/action-zip repository moved to the vimtor organization while the papeloto organization namespace became available, creating a repojacking condition for consumers of the action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A GitHub Actions supply-chain attack compromised widely used actions including **`tj-actions/changed-files`** and components in the **reviewdog** ecosystem after attackers abused insecure workflow patterns to steal maintainer personal access tokens and move trusted tags to malicious code. Investigators traced the intrusion to a malicious pull request against the SpotBugs ecosystem using the dangerous **`pull_request_target`** trigger, which exposed a maintainer token that was later used to implant another workflow, steal additional tokens, and overwrite action tags. The malicious action chain leaked CI/CD secrets and environment variables by dumping runner memory into workflow logs, affecting downstream repositories at scale and including a targeted attempt involving Coinbase, which said the incident did not damage its assets. Separate research showed that GitHub Actions integrations with Azure via OpenID Connect can also be undermined when federated identity credentials trust unsafe subject identifiers such as unprotected branches, tags, environments, or especially **`pull_request`**, allowing contributors to obtain Azure access tokens under weak configurations. The analysis found that even reusable workflows constrained with **`job_workflow_ref`** can still expose cloud access if the workflow permits caller-controlled code execution through mechanisms such as script injection or Terraform plan behavior. Together, the findings show that GitHub Actions trust boundaries can fail both in software supply chains and cloud federation unless organizations pin actions to commit SHAs, protect refs, minimize token permissions, validate reusable workflows, and enforce least-privilege access to secrets and cloud roles.
Aug 19, 2026
Threat actors compromised the popular GitHub Actions repositories `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` by moving version tags to imposter commits outside the normal commit history, causing workflows that referenced those tags to fetch and run malicious code. Researchers said the payload downloaded the **Bun** JavaScript runtime, read memory from the GitHub Actions `Runner.Worker` process to recover decrypted secrets, and exfiltrated the data over HTTPS to the attacker-controlled domain `t.m-kosche[.]com`; workflows pinned to a known-good full commit SHA were not affected. GitHub later disabled access to the repository for a terms-of-service violation, while StepSecurity added the action to its Compromised Actions Policy and blocked the exfiltration domain through Harden-Runner. The incident highlights a broader GitHub Actions supply-chain risk in which CI/CD trust can be subverted through mutable references and weak integrity controls. Separate research showed that a modified Maven wrapper in a pull request could achieve code execution on GitHub-hosted runners and, if merged, later expose release secrets such as Maven publishing credentials and GPG material, underscoring the need for checksum validation on wrapper scripts and immutable pinning to trusted commit SHAs for third-party actions. StepSecurity also linked the same exfiltration infrastructure to the recent **Mini Shai-Hulud** activity targeting npm packages in the `@antv` ecosystem, suggesting the GitHub Actions compromise may be part of a wider supply-chain campaign.
Jun 29, 2026
Researchers and maintainers disclosed multiple GitHub Actions security issues that could let attackers steal credentials or gain code execution in CI/CD pipelines. Sansec and Packagist warned that older Composer releases could print raw `GITHUB_TOKEN` values into GitHub Actions logs after rejecting GitHub’s newer hyphenated token format, creating a supply-chain risk for PHP projects, especially public repositories and older repositories where the default token still had write access. Composer issued fixes in versions `2.9.8`, `2.2.28`, and `1.10.28`, while GitHub rolled back the token format rollout to reduce immediate exposure. Separate disclosures showed how workflow design and cache handling can turn limited CI access into broader repository compromise. A newly assigned `CVE-2026-42603` affects OWASP BLT before `2.1.2`, where a privileged `pull_request_target` workflow checked out and executed code from an attacker-controlled fork, enabling remote code execution with repository write permissions. Earlier research on GitHub Actions cache poisoning described "Actions Cache Blasting," a technique that abuses client-controlled cache keys, cache eviction, and lingering runtime tokens to replace cached artifacts used by more privileged workflows, potentially leading to secret disclosure, release-signing compromise, and tampered build outputs without visible changes in source code or workflow logs.
Jun 29, 2026