🧰 StepSecurity Harden-Runner

The items that name it 11

• OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
  writeup2026-10-24It is written here as StepSecurity Harden-Runner: would flag the stealer's egress to a bare-IP /upload endpoint and periodic getSignaturesForAddress calls to Solana RPC providers in CI..
• eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update
  article2026-10-22It is written here as StepSecurity Harden-Runner: monitors outbound connections in CI workflows, correlates them with workflow steps and restricts destinations by network policy.
• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
  writeup2026-08-28

  Records process and network activity in GitHub Actions runners; used to reproduce and validate the malicious installation and runtime payload behavior; in block mode permits only allowlisted endpoints

• Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper
  writeup2026-08-22

  Runtime monitoring of GitHub Actions workflows; detected the anomalous outbound connection to the payload host in audit mode and automatically blocked it via global block list once the IOC was added

• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  writeup2026-07-30

  CI/CD runtime security monitoring; records process, file, and network events; used to detonate malicious package versions in a sandbox, audit outbound network calls, and block unallowlisted destinations

• Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
  writeup2026-07-25

  GitHub Actions runner security tool used to detonate the malicious package in a sandbox, detect and block secret exfiltration attempts, enforce a Global Block Policy against known C2 domains, and perform baseline anomaly detection on network destinations.

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
  writeup2026-07-19

  Runtime monitoring for GitHub Actions runners; in audit mode captured the full kill chain (network, process tree, file activity) of the compromised gems; in block mode restricts outbound connections to an allowed baseline to stop loaders reaching unexpected hosts.

• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeup2026-06-18It is written here as StepSecurity Harden Runner.

  Security agent for CI/CD runners that monitors network events, process executions, and file access at the step level in GitHub Actions; in block mode it enforces an outbound-endpoint allowlist and blocked the postinstall dropper's call to the stage-2 C2 (23.254.164.92:8000), preventing the rest of t

• Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter
  writeup2026-06-09

  CI/CD security tool that can detect and alert on force pushes as part of broader CI/CD security posture.

• Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
  writeup2026-06-02

  Used in audit mode to detonate laravel-lang/http-statuses v3.4.5 in an isolated GitHub Actions runner (run 26318135547), capturing the process tree and network calls (GET https://flipboxstudio.info/payload and POST https://flipboxstudio.info/exfil), and to attribute detections of HTTPS calls to flip

• actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials - StepSecurity
  advisory

  Runtime security monitoring for GitHub Actions runners; captured the bun download, Runner.Worker memory read, and outbound call to t.m-kosche.com in a controlled test run; global block list blocks outbound connections to the exfiltration domain even in audit mode