🎯 CI/CD secret theft

The items that name it 4

• Prasenjit Sarkar (@stretchcloud) on X
  thread2026-10-24It is written here as CI/CD secret theft: pushing a workflow to a throwaway branch, running it with real secrets, then deleting the branch to hide it.
• GitHub Action Canaries
  repo2026-07-11

  An attacker who has obtained a runner's environment and is probing for usable credentials

• Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets
  writeup2026-06-24

  Compromise targets GITHUB_TOKEN and frequently NPM_TOKEN with publish access held by workflows using the action for automated releases

• Socket: pnpm 11 Adds Supply Chain Protection Defaults
  article2026-05-07

  Part of the combined technique chain in recent supply chain campaigns, alongside compromised credentials, poisoned package releases, lifecycle scripts, external payload downloads, and propagation attempts.