All news with #github actions tag

🔒 Two GitHub Actions that were compromised in May 2026 and disabled by GitHub were re-enabled on September 16, 2026, restoring access to repositories containing unremediated malicious release tags. Socket researcher Karlo Zanki warned that workflows referencing the affected tags resumed downloading and executing the May 18 payload, which harvests CI/CD secrets and exfiltrates them. Developers are urged to pin to pre‑compromise SHAs, rotate secrets, audit workflow history, and remove or replace the affected actions.

🛡️ CloudSEK reported a supply chain attack where an attacker used a maintainer account to publish a malicious loader, GHAPPIER, in a legitimate npm package with valid provenance. The attacker altered workflows to auto-publish via GitHub Actions OIDC and Sigstore attestation, allowing a malicious release to pass npm audit signatures. The loader triggered a multi-stage chain ending in a ephemeral remote shell and was present briefly in version 0.2.21; CloudSEK found extensive reuse across repositories and recommends pinning and workflow monitoring.

🔒 Researchers at Wiz disclosed a GitHub Actions workflow injection in Snowflake's snowflakedb/snowflake-connector-net repo that allowed attacker-controlled issue fields to be expanded into a shell run: block, exposing JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN. The vulnerability stemmed from unsafe expression expansion in .github/workflows/jira_issue.yml and incorrect event property checks, which let a crafted public issue reach the job. Snowflake patched the workflow the same day Wiz reported it and rotated the exposed Jira token; no evidence of unauthorized access or affected releases was found.

🛡️ In June 2026, Novee Security disclosed "Cordyceps," a CI/CD composition weakness across thousands of high-impact repositories that flagged 654 and confirmed 300+ exploitable cases. The issue stems from how GitHub Actions events like pull_request_target and workflow_run execute with elevated privileges and can be tricked into running attacker-controlled content. Each workflow file appears valid, so SAST/DAST tools miss the cross-file composition that enables command, code injection and cross-workflow privilege escalation. Vendors have patched, but the broader governance gap—exacerbated by AI-generated workflows—remains and requires stricter trust boundaries and provenance controls.

🔍 Kaspersky researchers analyzed GitHub Actions across ~30,000 popular repositories and scanned ~130,000 pipelines using new rules in Kaspersky Container Security. Only 10% of repositories showed no concerns; the scan flagged over 250,000 potential deviations from secure CI/CD recommendations, with 0.4% classified as high risk and eight repositories containing critical flaws that could enable supply chain compromise. The study highlights common errors like exposed secrets, insecure run conditions, and unsafe handling of external data, and the ruleset is now available to KCS users.

🔒 GitHub is updating the official actions/checkout action to refuse common pwn request patterns by default, effective June 18, 2026, with backports planned for July 16, 2026. The change prevents checking out forked pull request head or merge commits in pull_request_target and certain workflow_run events unless authors explicitly set allow-unsafe-pr-checkout to true. This aims to reduce attacks that exploit privileged workflows to steal secrets or the GITHUB_TOKEN.

🔒 GitHub has updated actions/checkout to v7 to automatically block and fail workflows that attempt to fetch unreviewed fork pull request code when run under pull_request_target or workflow_run events. The change enforces a secure-by-default behavior, with an explicit opt-out allow-unsafe-pr-checkout available for developers who need it. Backports to supported major versions are planned beginning July 16; pinned SHAs and specific versions must be updated manually.

🔒 A researcher discovered a vulnerability in Anthropic's Claude Code GitHub Action that allowed takeover of public repositories via a single opened GitHub issue. Anthropic patched the core bypass in January and released fixes in claude-code-action v1.0.94, rating the issue 7.8 under CVSS v4.0 and issuing a bounty. The flaw arose from overly permissive triggers that trusted actors ending in "[bot]" and example workflows allowing non-write users, enabling indirect prompt injection to exfiltrate environment secrets and OIDC credentials. Administrators should update to v1.0.94, audit workflows for untrusted inputs, and remove unnecessary permissions and tools to prevent exfiltration.

🔒 Researchers at SafeDep uncovered the Megalodon campaign that pushed 5,718 malicious commits into 5,561 public GitHub repositories during a six-hour window on May 18. The attackers modified GitHub Actions workflows to embed base64-encoded bash payloads designed to exfiltrate CI-exposed secrets such as cloud credentials, SSH keys, and OIDC tokens. The campaign used compromised Personal Access Tokens or deploy keys and forged author identities like build-bot to directly commit changes without PRs, and delivered two payload variants that either ran on every push or via workflow_dispatch triggers.

🔒 Microsoft disclosed an active supply-chain attack that compromised an @antv npm maintainer account and published malicious versions of charting libraries, including echarts-for-react. The obfuscated ~499 KB JavaScript payload executes during npm install and targets GitHub Actions runners to harvest secrets from GitHub, AWS, HashiCorp Vault, npm, Kubernetes and 1Password by scraping process memory and enumerating secret stores. The campaign leverages privilege escalation, dual-channel exfiltration, and SLSA provenance forgery to evade detection; GitHub removed malicious packages and invalidated exposed tokens.

🔒 Security researchers from StepSecurity report that the popular GitHub Actions workflow actions-cool/issues-helper was hijacked by attackers who moved existing tags to imposter commits in an adversary-controlled fork. The malicious commit downloads the Bun JavaScript runtime, reads memory from the Runner.Worker process to harvest CI/CD credentials, and exfiltrates them to an attacker-controlled domain. A second action, actions-cool/maintain-one-comment, had 15 tags similarly altered. GitHub has disabled repository access and only workflows pinned to full commit SHAs remain unaffected.

⚠️ Socket reports a wave of the Mini Shai‑Hulud campaign modified 84 npm artifacts in the @tanstack namespace on 11 May 2026, inserting a heavily obfuscated credential‑stealing payload. Attackers abused GitHub Actions via the pull_request_target pattern, cache poisoning and runtime OIDC token extraction to hijack release pipelines. Affected packages included high‑download modules like @tanstack/react-router, and the GitHub Advisory Database rated the incident critical.

🚨 Malicious release v0.23.3 of the elementary-data PyPI package was published after an attacker exploited a GitHub Actions script-injection flaw in the project's workflow. The tainted package and its Docker image silently installed an elementary.pth-based loader that exfiltrated SSH keys, cloud credentials, developer tokens and cryptocurrency wallets. A clean v0.23.4 was released, but users who pulled the compromised artifacts must rotate secrets and remediate affected environments.

🔒 The Trivy open-source scanner and its GitHub Actions integrations (aquasecurity/trivy-action and aquasecurity/setup-trivy) were compromised in March 2026 when an attacker force-pushed 75 version tags to point to malicious commits. The injected Python infostealer harvests CI/CD secrets from runners, attempts exfiltration to an attacker-controlled domain, and can stage stolen data using captured PATs if network exfiltration fails. Vendors advise immediate secret rotation, blocking the malicious domain/IP, and pinning Actions to full commit SHAs.

🐛 Socket researchers disclosed an active npm supply-chain campaign dubbed SANDWORM_MODE that leverages typosquatted packages to infiltrate developer machines, CI pipelines, and AI coding assistants. The malicious packages (at least 19 observed) harvest npm and GitHub tokens, environment secrets, and cloud keys, then use stolen credentials to modify repositories and amplify via weaponized GitHub Actions. The campaign also injects a malicious MCP server into AI tool configs to enable prompt-injection exfiltration, includes a dormant polymorphic engine, and implements a configurable 'dead switch' that can wipe home directories.

🚀 AWS Elastic Beanstalk now offers an official GitHub Action that automates deployments when you push code or configuration changes, simplifying CI/CD for web applications. The action creates applications and environments as needed, packages and uploads artifacts to S3, and manages application versions and environment settings. It supports health checks, deployment validation, configurable exclusions for package contents, intelligent retry logic, and integrates with IAM via OpenID Connect for secure, token-based authentication. The action is available in all commercial AWS Regions where Elastic Beanstalk is offered.

⚠️ Researchers at Aikido Security discovered that AI agents embedded in CI/CD workflows can be manipulated to execute high-privilege commands by feeding user-controlled strings (issue bodies, PR descriptions, commit messages) directly into prompts. Workflows pairing GitHub Actions or GitLab CI/CD with tools like Gemini CLI, Claude Code, OpenAI Codex or GitHub AI Inference are at risk. The attack, dubbed PromptPwnd, can cause unintended repository edits, secret disclosure, or other high-impact actions; the researchers published detection rules and a free scanner to help teams remediate unsafe workflows.

🔍 Cybersecurity researchers uncovered a malicious npm package, @acitons/artifact, that typosquats the legitimate @actions/artifact package to target GitHub-owned repositories. Veracode says versions 4.0.12–4.0.17 included a post-install hook that downloaded and executed a payload intended to exfiltrate build tokens and then publish artifacts as GitHub. The actor (npm user blakesdev) removed the offending versions and the last public npm release remains 4.0.10. Recommended actions include removing the malicious versions, auditing dependencies for typosquats, rotating exposed tokens, and hardening CI/CD supply-chain protections.

🐛 Security researchers report at least 187 npm packages compromised in an active supply-chain campaign dubbed Shai‑Hulud. The malware, first observed in the widely used @ctrl/tinycolor package, includes a self‑propagating payload that injects a bundle.js, abuses TruffleHog to harvest tokens and cloud credentials, and creates unauthorized GitHub Actions workflows to exfiltrate secrets. Affected vendors including CrowdStrike say they removed malicious packages and rotated keys; developers are urged to audit environments, rotate secrets, and pin dependencies.

🦠 On the evening of September 15 a worm-like supply-chain attack began targeting popular npm components, compromising nearly 150 packages including @ctrl/tinycolor. Malicious code was added as a cross-platform postinstall script (bundle.js) that harvests credentials using a bundled TruffleHog, validates tokens via npm and GitHub APIs, and — where possible — publishes trojanized package updates. Harvested secrets are exfiltrated by creating public GitHub repositories and by deploying GitHub Actions that forward data to an attacker-controlled webhook.