🧰 GitHub Actions

The items that name it 178

• A quiet week in infosec <.<
  articleas affected products2026-10-29It is written here as GitHub Actions (logs exposed secrets in the Gheist campaign).

  logs exposed secrets in the Gheist campaign

• David Gutierrez | Eng (@david_x_ai) on X
  threadas classification.technologies2026-10-26
• The Pwn Request Reckoning: What Still Works Against GitHub Actions
  articleas classification.technologies2026-10-26
• alex lee (@alexlee20122022) on X
  threadas classification.technologies2026-10-25
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeupas classification.technologies2026-10-25
• Prasenjit Sarkar (@stretchcloud) on X
  threadas classification.technologies2026-10-24
• New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
  writeupas classification.technologies2026-10-23
• ADLC Security Best Practices for Teams Shipping with Coding Agents | Endor Labs
  articleas classification.technologies2026-10-23
• Spectrmachina/Ztrust
  repoas classification.technologies2026-10-22
• SecureChap (@SecureChap) on X
  threadas classification.technologies2026-10-22
• Software supply chain security best practices for 2026
  articleas affected products2026-10-21
• The OpenSourceMalware Show #26
  talkas affected products2026-10-21It is written here as GitHub Actions (target of GhostAction malicious workflows; the OVH compromise itself did not happen in GitHub Actions).

  target of GhostAction malicious workflows; the OVH compromise itself did not happen in GitHub Actions

• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas classification.technologies2026-10-16
• GitHub Action tj-actions/changed-files supply chain attack: what you need to know | Endor Labs
  articleas classification.technologies2026-10-16
• What We Can Learn About GitHub Actions Security from the Trivy Breach | Endor Labs
  articleas classification.technologies2026-10-16
• PWN Request Threat: A Hidden Danger in GitHub Actions | Endor Labs
  articleas tools2026-10-16It is written here as GitHub Actions (workflow automation platform; actions can be JavaScript, Docker-based, or Composite).

  workflow automation platform; actions can be JavaScript, Docker-based, or Composite

• The OpenSourceMalware Show #25
  talkas affected products2026-10-15It is written here as GitHub Actions (workflows referencing mutable tags).

  workflows referencing mutable tags

• Staying Evergreen: How we automated secure access and repo hygiene in a shared org
  articleas classification.technologies2026-10-15
• Penetration testing every deployment with AWS Continuum
  articleas classification.technologies2026-10-14
• Supply Chain Attack targeting Cline installs OpenClaw | Endor Labs
  writeupas classification.technologies2026-10-12
• New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs
  articleas affected products2026-10-12
• How a Misconfigured CI Workflow Became an npm Supply-Chain Compromise | Blog | Endor Labs
  writeupas tools2026-10-12It is written here as GitHub Actions (CI/CD platform).

  CI/CD platform

• GhostAction Phishing Campaign
  writeupas classification.technologies2026-10-11
• GhostAction Attack Escalates By Targeting GitHub Users
  writeupas affected products2026-10-09It is written here as GitHub Actions (workflows; secrets expanded via ${{ secrets.NAME }}).

  workflows; secrets expanded via ${{ secrets.NAME }}

• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
  writeupas tools2026-10-09

  CI/CD platform abused to run malicious workflows disguised as security audits that exfiltrate secrets and credentials

• New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
  writeupas affected products2026-10-09

  CI/CD platform whose secrets (e.g. CARGO_REGISTRY_TOKEN, PERSONAL_ACCESS_TOKEN, PYPI_PASSWORD, PYPI_USERNAME) are harvested by the injected workflow.

• In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
  articleas affected products2026-10-09

  abused by GhostAction campaign to steal secrets from public repositories

• Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs
  advisoryas tools2026-10-08

  CI/CD pipeline that built and published the malicious release with valid build provenance after the main branch was compromised

• SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors
  writeupas classification.technologies2026-10-05
• https://github.com/praetorian-inc/gato
  toolas affected products2026-10-02

  Self-hosted runners for GitHub Actions, particularly those with default configurations, are often vulnerable; GitHub recommends self-hosted runners only be used for private repositories, but many organizations use them on public repositories.

• Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts
  articleas classification.technologies2026-09-30
• https://github.com/dmdhrumilmistry/security-harness
  repoas classification.technologies2026-09-29
• Julio Bandeira de Melo (@juliobmelo) on X
  threadas classification.technologies2026-09-28
• graygnatconsole/mcp-audit-tool
  repoas classification.technologies2026-09-26
• Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
  writeupas classification.technologies2026-09-24
• Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure
  articleas affected products2026-09-24It is written here as GitHub Actions (cache poisoning, mutable action tags, OIDC token extraction).

  cache poisoning, mutable action tags, OIDC token extraction

• Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes
  writeupas classification.technologies2026-09-23
• npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader
  articleas tools2026-09-22

  CI/CD release workflow that was modified by attackers so any push to main triggered an automated release.

• StellarFoundry/soroban-security-scanner
  repoas classification.technologies2026-09-21
• Workflow execution protections in GitHub Actions generally available - GitHub Changelog
  articleas affected products2026-09-17

  Workflow execution protections now generally available

• GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
  articleas affected products2026-09-16

  shared Actions cache subject to cache poisoning; added cache-mode setting

• Threat Hunter's Guide to GitHub (Datadog Security Labs)
  writeupas classification.technologies2026-09-16
• RepoGuardBench
  repoas tools2026-09-13

  CI running the unit suite, no-GPU end-to-end smoke test, table regeneration, paper-claim verification, and secret/path/PII release scan across Python 3.10-3.12

• Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs
  writeupas classification.technologies2026-09-11
• SolarWinds took a nation-state. The next attack just needs an LLM and $5. | Blog | Endor Labs
  articleas affected products2026-09-11

  Platform criticized for design flaws: mutable Git tags, pull_request_target workflow with full secret access to untrusted fork code, no lockfile, no full dependency graph; exploited in the tj-actions/changed-files compromise and the TeamPCP campaign.

• [tl;dr sec] #344 - VMs won't contain Cyber-capable Agents, AWS AI Security Analyst, Decompilers vs LLMs
  articleas affected products2026-09-08
• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
  articleas affected products2026-09-08It is written here as GitHub Actions (malicious workflow created for a company's proprietary AI repository).

  malicious workflow created for a company's proprietary AI repository

• vet (SafeDep)
  repoas affected products2026-09-07

  Workflows scanned for malware via vet scan -D .github/workflows

• ForgeGuardian
  repoas affected products2026-09-05
• OWASP OASIS
  repoas tools2026-09-05

  Considered (open question) for maintaining weighted validation scores automatically

• A trust checklist for GitHub Actions
  writeupas affected products2026-09-04It is written here as GitHub Actions (workflow uses: references).

  workflow uses: references

• GHSL-2026-203: Same-second TOCTOU in jupyterlab/maintainer-tools
  advisoryas classification.technologies2026-09-04
• Top AI coding agent security resources — September 2026
  articleas classification.technologies2026-09-03
• Introducing deny list egress policies for Harden-Runner
  articleas classification.technologies2026-09-02
• Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners
  articleas affected products2026-09-02

  ubuntu-latest and other GitHub-hosted runners; jobs increasingly pointed at AWS CodeBuild-hosted runners instead.

• Claude Code & Gemini CLI: GitHub Issue → CI Secrets
  writeupas classification.technologies2026-09-01
• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
  writeupas classification.technologies2026-08-28
• NPM Isn't Prepared For North Korean PolinRider Attack
  writeupas classification.technologies2026-08-25
• Shai-Hulud was the best thing to happen to supply chain security
  articleas tools2026-08-24

  CI/CD platform whose misconfigurations (Pwn Requests via pull_request_target, cache poisoning) were repeatedly exploited

• The State of Open Source Supply Chain Attacks
  articleas classification.technologies2026-08-23
• Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper
  writeupas classification.technologies2026-08-22
• Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR
  writeupas classification.technologies2026-08-17
• Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List.
  articleas affected products2026-08-15

  One of the major CI/CD platforms affected; not the sole platform involved despite being commonly assumed.

• DocsGPT Security Hardening Playbook
  writeupas classification.technologies2026-08-15
• [tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements
  articleas classification.technologies2026-08-13
• Why NPM Malware Keeps Reaching for Bun | Supply Chain Security | Blog | Endor Labs
  articleas classification.technologies2026-08-12
• Control Which Package Registries Your CI Jobs and Developer Machines Use
  articleas classification.technologies2026-08-12
• Cloud Threat Highlights: H1 2026
  writeupas affected products2026-08-06

  CI misconfigurations exploited by TeamPCP to poison build caches.

• npm-scan
  repoas tools2026-08-05

  CI/CD platform integration for npm-scan

• NPM Malware Compromises keyv and cacheable with 500M+ Weekly Downloads and Spreads to Hundreds of Packages | Blog | Endor Labs
  advisoryas classification.technologies2026-08-04
• Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
  writeupas classification.technologies2026-08-04
• 'ChainDrop' worm compromises hundreds of popular npm packages
  writeupas classification.technologies2026-08-04
• Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It
  articleas classification.technologies2026-08-03
• Nomos
  repoas classification.technologies2026-08-02
• Slither
  repoas classification.technologies2026-07-31
• When the Guardrails Slip: The Case for Hook-Based Governance Across Agent Platforms | Blog | Endor Labs
  articleas classification.technologies2026-07-31
• The OpenSourceMalware Show #15
  talkas classification.technologies2026-07-31
• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  articleas affected products2026-07-31

  Covered in GitHub's July 28, 2026 piece on disrupting supply chain attacks, alongside npm, via checkout defaults and account protection

• Using Claude’s Security Review Skill in Claude Code
  articleas classification.technologies2026-07-29
• From Container Escape to Cloud Takeover
  writeupas tools2026-07-26
• Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
  writeupas classification.technologies2026-07-25
• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeupas affected products2026-07-23

  CI/CD automation service abused via malicious workflow files (.github/workflows) in compromised repositories to launch ephemeral Ubuntu runners for scanning, exploitation, and data exfiltration.

• Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
  articleas affected products2026-07-23

  Repository secrets used in workflows across GitHub organizations

• Gabson0x/pentdem
  repoas tools2026-07-20

  CI/CD workflow generation for deployment gating based on severity

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
  writeupas classification.technologies2026-07-19
• AI Security Briefing
  writeupas tools2026-07-18

  GitHub's automation system for running tasks in response to repository events

• dstours/OctoC2
  repoas classification.technologies2026-07-18
• The OpenSourceMalware Show #13
  talkas affected products2026-07-16It is written here as GitHub Actions (AsyncAPI workflow).

  pull_request_target flaw left unresolved for 58 days, exploited to steal a privileged token

• Introducing Secret Exfiltration Protection for GitHub Actions
  articleas affected products2026-07-16

  CI/CD workflows used as the exfiltration/cash-out mechanism in all four campaigns

• Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories
  writeupas classification.technologies2026-07-16
• Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners
  articleas classification.technologies2026-07-16
• Socket: Operation Muck and Load
  writeupas classification.technologies2026-07-16
• Strix
  repoas tools2026-07-15

  CI/CD integration for running Strix security scans automatically on pull requests

• HOL Guard
  repoas classification.technologies2026-07-15
• SreeragPramod/securepipe
  repoas tools2026-07-15

  CI/CD pipeline runner that automates code quality, security, and test gates on every push

• How Unprotected Release Branches Let Attackers Compromise AsyncAPI | Blog | Endor Labs
  writeupas classification.technologies2026-07-14
• M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
  writeupas tools2026-07-14

  CI/CD platform whose pull_request_target misconfiguration ("pwn request") was exploited to access secrets.

• AsyncAPI npm packages backdoored via GitHub Actions
  writeupas classification.technologies2026-07-14
• LocxZ/SecureSDLC-Lab
  repoas tools2026-07-14

  CI/CD pipeline automating security checks on every push and pull request

• How Aikido Intel detects malware and vulnerabilities first
  articleas classification.technologies2026-07-13
• GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps
  articleas affected products2026-07-12

  Workflow run logs and artifacts are a proven exposure path (e.g., tj-actions/changed-files compromise); malicious workflows used in GhostAction campaign

• Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys
  writeupas tools2026-07-12It is written here as GitHub Actions (trusted-publisher/OIDC pipeline).

  CI/CD workflow (.github/workflows/publish.yaml) used to automatically build and publish the npm packages via npm provenance attestation/OIDC, which propagated the malicious release to all 18 packages within minutes

• GitHub Action Canaries
  repoas classification.technologies2026-07-11
• DataDog/guarddog
  repoas affected products2026-07-11It is written here as GitHub Actions (JavaScript-implemented).

  JavaScript-implemented

• apisec-inc/AI-Surface
  repoas classification.technologies2026-07-11
• The Bitwarden CLI Supply Chain Attack: What Happened and What to Do | Blog | Endor Labs
  writeupas classification.technologies2026-07-10
• 0xSteph/pentest-ai
  repoas classification.technologies2026-07-04
• 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions
  writeupas classification.technologies2026-07-02
• StepSecurity Maintained Actions Are Now Free for Public Repos
  articleas classification.technologies2026-07-02
• codfish/semantic-release-action GitHub Action has been compromised
  writeupas classification.technologies2026-07-01
• simonecorsi/mawesome GitHub Action has been compromised
  advisoryas classification.technologies2026-07-01
• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeupas classification.technologies2026-07-01
• And another one. GitHub ships break-glass credential revocation
  articleas tools2026-07-01

  CI/CD automation platform; discussed regarding per-job tokens and the ability to disable Actions on a repository to limit damage during an incident.

• Socket: Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages
  writeupas tools2026-06-27

  CI/CD automation platform abused for workflow injection, deployment-triggered execution, and secret theft

• Automating Penetration Testing with SecureCodeBox on Kubernetes (Kind) + GitHub Actions
  writeupas classification.technologies2026-06-25
• Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets
  writeupas classification.technologies2026-06-24
• Socket: actions/checkout v7 Blocks Unsafe pull_request_target Checkouts
  articleas classification.technologies2026-06-22
• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeupas classification.technologies2026-06-18
• VICE
  repoas classification.technologies2026-06-14
• OpenSource Malware: Active Malware Campaigns in January-May 2026
  writeupas classification.technologies2026-06-12
• The OpenSourceMalware Show #8
  talkas classification.technologies2026-06-11
• Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents
  writeupas classification.technologies2026-06-09
• Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter
  writeupas classification.technologies2026-06-09
• New in the Threat Center: Compromised Components, Now Available via API
  articleas affected products2026-06-09

  Affected Actions can be involved in supply chain compromise incidents tracked in the Threat Center

• Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds
  writeupas classification.technologies2026-06-06
• cicd-sensor: eBPF Runtime Security for CI/CD Pipelines
  repoas affected products2026-06-04

  CI/CD pipelines, GitHub-hosted and self-hosted runners

• Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
  writeupas classification.technologies2026-06-04
• The OpenSourceMalware Show #7
  talkas classification.technologies2026-06-03
• Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
  writeupas classification.technologies2026-06-02
• Orca Security: Red Hat npm Packages Compromised in Supply-Chain Attack Spreading Credential-Stealing Worm
  articleas tools2026-06-02It is written here as GitHub Actions (workflows and OIDC tokens abused to publish packages).

  workflows and OIDC tokens abused to publish packages

• Orca Security: Securing Shadow AI: How to Detect Unapproved LLMs in Your Cloud
  articleas classification.technologies2026-06-01
• Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm
  writeupas classification.technologies2026-06-01
• Miasma: Supply Chain Attack Targeting RedHat npm Packages
  writeupas tools2026-06-01

  CI/CD workflow abused by attackers; flagged as something organizations should audit for signs of compromise

• OSV
  toolas classification.technologies2026-05-25
• OWASP Noir
  repoas classification.technologies2026-05-24
• KeygraphHQ/shannon
  repoas classification.technologies2026-05-23
• Socket: Malicious Postinstall Hook Compromises 8 PHP/Node Packages on Packagist
  writeupas classification.technologies2026-05-23
• Socket: Mini Shai-Hulud
  articleas classification.technologies2026-05-22
• Bringing full YAML anchor support to zizmor
  articleas classification.technologies2026-05-22
• Anthropic Silently Patches Claude Code Sandbox Bypass
  articleas classification.technologies2026-05-20
• Socket: TeamPCP + BreachForums Launch $1,000 Contest for Supply Chain Attacks
  articleas affected products2026-05-20

  CI/CD workflow platform targeted by TeamPCP

• Socket: TanStack npm Packages Compromised
  writeupas classification.technologies2026-05-20
• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeupas classification.technologies2026-05-19
• Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages
  articleas classification.technologies2026-05-19
• FoxGuard
  repoas classification.technologies2026-05-16
• Socket: Packagist Urges Immediate Composer Update After GitHub Actions Token Leak
  advisoryas affected products2026-05-13

  GITHUB_TOKEN and GitHub App installation tokens exposed in CI logs due to new token format including a hyphen not accepted by Composer's validation regex

• Agentic Workflows
  articleas affected products2026-05-13

  underlying platform on which compiled .lock.yml workflows run

• Security Architecture of GitHub Agentic Workflows
  articleas affected products2026-05-13

  Execution environment/runner VM on which Agentic Workflows run; by default everything runs in the same trust domain

• Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack
  writeupas classification.technologies2026-05-11
• The complete GitHub Actions security checklist
  articleas affected products2026-05-11

  GitHub's built-in CI/CD and automation system; primary subject of the checklist's misconfiguration risks.

• claude-code-security-review
  repoas tools2026-05-10

  CI/CD platform used to run the claude-code-security-review action on pull requests

• Pantheon-Security/medusa
  repoas classification.technologies2026-05-10
• TrustFall: 1-click coding agent RCE in Claude, Cursor, Copilot
  writeupas classification.technologies2026-05-07
• Socket: Bitwarden CLI Compromised in Checkmarx Supply Chain Campaign
  writeupas tools2026-05-06

  CI/CD pipeline abused via compromised GitHub Action to inject malicious code into Bitwarden's build

• CNCF Security Best Practices
  articleas classification.technologies2026-05-06
• Terraform Compliance Guardrails
  repoas tools2026-05-06It is written here as GitHub Actions (OIDC).

  CI/CD integration with AWS

• BufferZoneCorp Malicious Gems & Go Modules
  writeupas affected products2026-05-06

  CI/CD environments targeted via tampering with GITHUB_ENV, GITHUB_PATH, GOPROXY, GOSUMDB, GONOSUMDB, GOFLAGS, GOMODCACHE, and go.sum.

• Mini Shai-Hulud Worm (Apr–May 2026)
  articleas tools2026-05-06

  CI/CD platform; abused via malicious workflow files (e.g., .github/workflows/format-check.yml, test.yml) configured to dump secrets (${{ toJSON(secrets) }}) and upload them as artifacts, and to trigger automated publish of the malicious package.

• CI/CD Threat Modelling
  articleas tools2026-05-06

  CI/CD workflow automation platform, used as a specific example throughout the framework (e.g. workflow definition location/trust model, injection example using ${{ github.event.pull_request.title }})

• Butler
  repoas classification.technologies2026-05-06
• PyPI Access Control Vulns Patched
  articleas classification.technologies2026-05-06
• Cooldowns.dev
  articleas classification.technologies2026-05-06
• OWASP Free AppSec Tools
  articleas classification.technologies2026-05-06
• Negative Days in LLM Workflows
  writeupas classification.technologies2026-05-05
• GitHub Actions Security Pt 1: Attacks & Defenses | Wiz Blog
  articleas affected products2026-04-14

  CI/CD platform; core subject of threat model covering pull_request_target, script injection, and third-party action risks

• VulnCheck - Outpace Adversaries
  toolas classification.technologies
• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas affected productsIt is written here as GitHub Actions (multiple).

  Multiple GitHub Actions compromised during the wave via imposter commits (tag hijacking).

• Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
  articleas classification.technologies
• git-pkgs — dependency history & supply-chain analysis for git repos
  repoas classification.technologies
• Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader
  writeupas classification.technologies
• Securely using pull_request_target - GitHub Enterprise Cloud Docs
  articleas affected products

  pull_request_target event in public repositories; default event policy blocks pull_request_target for public repos without an applicable Actions event policy (does not apply to private or internal repositories)

• Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner
  repoas classification.technologies
• SANDWORM_MODE: Dissecting a Multi-Stage npm Supply Chain Attack | Blog | Endor Labs
  writeupas classification.technologies
• affaan-m/agentshield
  repoas classification.technologies
• agent-egress-bench
  repoas classification.technologies
• Dev Machine Guard Now Supports Linux - StepSecurity
  articleas classification.technologies
• Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories - StepSecurity
  writeupas affected products

  CI/CD workflow system targeted via injected malicious workflow files

• actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecurity
  advisoryas classification.technologies

In every workspace you can read 193