GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD Credentials

GitHub Actions supply chain attack compromised popular workflow actions by redirecting all tags to malicious commits containing credential-stealing code.

• •The attack involved two GitHub Actions: actions-cool/issues-helper and actions-cool/maintain-one-comment
• •Malicious code downloads Bun runtime, extracts credentials from Runner.Worker process memory, and exfiltrates data to attacker-controlled domain t.m-kosche[.]com
• •Attack uses imposter commit strategy, injecting code into attacker-controlled fork to bypass PR reviews
• •Workflows referencing actions by version tag are vulnerable; only workflows pinned to full commit SHA remain unaffected
• •GitHub disabled repository access due to terms of service violation

This summary was automatically generated by AI based on the original article and may not be fully accurate.