GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD Credentials
By [email protected] (The Hacker News)
AI Summary
Threat actors compromised the popular GitHub Actions workflow actions-cool/issues-helper, redirecting all existing repository tags to point to malicious imposter commits that harvest CI/CD credentials and exfiltrate them to an attacker-controlled server. The attack is notable because the malicious commits do not appear in the action's normal commit history, making detection difficult for teams relying on tag integrity. Organizations using this action in their pipelines should immediately audit workflow logs, rotate any exposed secrets, and pin actions to specific commit SHAs rather than tags.
Relevance score: 76.0/100
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →