Security researchers reported credential-stealing GitHub Actions workflows planted across tens of thousands of repositories. The campaign illustrates how a poisoned CI workflow can turn source-control automation into a route for exfiltrating tokens, cloud credentials, and other build secrets.
What to investigate
Repository owners should review recent workflow changes, especially edits that introduce unfamiliar third-party actions, outbound network requests, encoded shell commands, or unexpected access to secrets. Forks and inherited workflow files deserve attention too.
Immediate response steps
- Audit workflow history and organization-wide Actions settings.
- Disable or remove suspicious workflows, then rotate any credentials they could access.
- Restrict token permissions and use short-lived, scoped credentials where possible.
- Pin third-party actions to reviewed commit SHAs and require review for workflow changes.
- Check build logs and cloud audit trails for unauthorized use of exposed secrets.
CI/CD security is now supply-chain security: automation definitions should receive the same review and monitoring as application code.
Source: The Hacker News.