stepsecurity.ioarticleHarden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners
StepSecurity's Harden-Runner v2.20.0 extends egress-policy: block enforcement (previously Linux-only) to macOS and Windows GitHub-hosted runners, blocking outbound calls to non-allowlisted endpoints from compromised workflows or dependencies. The post cites the Megalodon (5,500 repos) and GhostAction (3,000+ secrets) exfiltration campaigns and the Velora DEX SDK npm-package backdoor as motivation, noting macOS/Windows runners handle Apple/Windows code-signing credentials that make supply-chain malware look legitimate.
TL;DR Harden-Runner adds egress block mode (not just audit) for macOS and Windows GitHub-hosted runners to stop secret exfiltration from compromised CI workflows.
Organisations named here
- Velora DEX SDK
Technologies named here
- GitHub-hosted runners
- Harden-Runner
- GitHub-hosted Linux runners
- GitHub Actions
- macOS
- Windows
- npm
- StepSecurity
Techniques named here
- Secret exfiltration via outbound network call
- Supply chain compromise via malicious dependency/package
- Malicious/poisoned GitHub Actions workflows
Threat actors named here
- Megalodon campaign
- GhostAction
- Velora DEX SDK compromise
- Megalodon
Related in DevSecOps
jfrog.comarticleJFrog: The Governance Gap Between Your Policy and Your Pipeline
stepsecurity.ioarticleDev Machine Guard Now Supports Windows - StepSecurity
socket.devwriteupSocket: TanStack npm Packages Compromised
securitylab.github.comadvisory