🧰 GitHub Code Search

The items that name it 9

• GitHub Action tj-actions/changed-files supply chain attack: what you need to know | Endor Labs
  article2026-10-16It is written here as GitHub code search (query org:[YOURORG] uses: tj-actions/ to find usage in workflows).

  query org:[YOURORG] uses: tj-actions/ to find usage in workflows

• GhostAction Attack Escalates By Targeting GitHub Users
  writeup2026-10-09It is written here as GitHub code search: hunting queries such as "193.32.204.199" path:.github/workflows, plus filename-, marker- and commit-message-specific queries.
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
  writeup2026-10-09

  used by defenders to hunt for campaign markers (e.g. "AKIA_CTX_START" path:.github/workflows, "c=monami", "193.32.204.199" path:.github/workflows) across indexed default branches

• Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
  writeup2026-09-24It is written here as GitHub code search (query uses: actions-cool/issues-helper@v in .github/workflows/ to find tag-based references).

  query uses: actions-cool/issues-helper@v in .github/workflows/ to find tag-based references

• PolinRider Spreads Through Compromised GitHub Accounts and Packagist
  article2026-09-17

  Used by defenders/researchers to search public repository state, though the page notes it misses private repos, historical states, and endpoint compromise

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23

  Used by researchers to search for the campaign's unique DNSHook identifier, C2 address, scanner command, credential filenames, heartbeat endpoint, and exfiltration logic, returning approximately 6,100 to 15,000-16,000 matching workflow files across unrelated repositories.

• One Fake Bug Report Hijacked a $250B Company’s AI Agent
  article2026-06-17

  Used as a discovery method to find target Sentry DSNs embedded in source code.

• Socket: Malicious Postinstall Hook Compromises 8 PHP/Node Packages on Packagist
  writeup2026-05-23

  Used by Socket to identify the broader scope of the campaign by searching for the attacker-controlled account, returning hundreds of public code results

• Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories - StepSecurity
  writeup

  Used to search for malicious workflow content (e.g. 'name: SysDiag', 'name: Optimize-Build', filenames) and forged commits to find affected repositories