GitHub Actions Workflow Compromises Expose CI/CD Secrets and Enable RCE

The GhostAction supply-chain campaign compromised 327 GitHub users and inserted malicious workflows into 817 repositories, stealing 3,325 CI/CD secrets. Workflows masquerading as “Github Actions Security” sent PyPI, npm, DockerHub, GitHub, AWS, database, and Cloudflare credentials by HTTP POST to attacker infrastructure, including 45.139.104.115; a later wave added exfiltration domains and hundreds of commits. Although no malicious package releases had been confirmed at disclosure, 24 affected packages—nine npm and 15 PyPI—remained at immediate risk, while some stolen credentials were reportedly already abused.

CI/CD workflows are also vulnerable to remote-code-execution exposure from unsafe pull_request_target configurations, artifact-token leaks such as ArtiPACKED, and attacks including HackerBot-Claw. Elastic Security Labs released the open-source cicd-abuse-detector to review GitHub Actions, GitLab CI, and Azure DevOps changes before merge or deployment, extracting more than 50 signals from pipeline files and analyzing diffs for secret exfiltration, privileged pull-request triggers, permission escalation, self-hosted-runner targeting, supply-chain manipulation, and timestamp abuse. The tool can issue pull-request, issue, Slack, and Elasticsearch alerts and optionally block risky pull requests.