Hacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?

on YouTube ↗32m

" summary

Research identifies concrete attack paths against GitHub Actions: repo jacking lets an attacker recreate moved action repositories because actions download not clone; a scripted Neo4j dependency crawl of ~7,000 Action-using repos finds 175 trivially exploitable cases, one chain infects 18 repos and extracts secrets from 72 downstream projects, and an upstream compromise reaches ~12,000 packages; tools include curl/webhooks, Docker privilege escalation, force-updated tags and a worm that crawls downstream which successfully runs and steals tokens unless actions are pinned or permissions set to read-only GitHub Actions token rewrite.

AI-written summary · about

" chapters (25)

1. 0:00Introduction to GitHub Actions security risks
2. 1:45What are GitHub Actions and why they matter
3. 2:49Research origins command injection vulnerabilities
4. 3:54Repo jacking attack vectors in GitHub Actions
5. 5:21NPM email hijacking and supply chain risks
6. 6:24Command injection in GitHub workflows
7. 8:10Dependency confusion and poison pipeline attacks
8. 8:54Self-approved workflows and security defaults
9. 10:19GitHub token rewrite capabilities before 2023
10. 11:46Reverse shell execution on GitHub Runners
11. 12:51Dangers of self-hosted GitHub Runners
12. 14:54Extending reach through dependency chains
13. 15:57Building a dependency attack graph with Neo4j
14. 17:00Mass exploitation of top GitHub repositories
15. 18:24Creating a GitHub Actions worm for secret theft
16. 20:09Live demo of the worm attack in action
17. 22:14Why this attack worked and how to prevent it
18. 23:58Securing workflows with GitHub Actions best practices
19. 24:40GitHub security lab and open source tools
20. 25:22Summary and open source countermeasures
21. 25:44Q&A session on Docker privilege escalation
22. 27:10Limiting outbound traffic from GitHub Runners
23. 28:35Docker command privilege escalation explained
24. 29:38Statistics on trusted GitHub Actions usage
25. 31:22Final thoughts on open source security

" related talks

• 17mIs My (Open Source) Project Safe?Stephen Giguere · KCD New York 2024
• 23mBreaking the Build: How Attackers Abuse GitHub ActionsJonathan Evans · CVE/FIRST VulnCon 2025
• 55mBeyond the Commit: Weaponizing and Hardening GitHub ActionsNiek Palm · NDC Security 2026
• 55mGitHub Actions: Vulnerabilities, Attacks, And Counter-MeasuresMagno Logan · Global AppSec Dublin 2023
• 56mHow to use GitHub Actions with Security in mindRob Bos · NDC Security 2022
• 57mGitHub Actions: Vulnerabilities, Attacks, and Counter-measuresMagno Logan · NDC Security 2023
• 15mGitHub Actions: a time bomb for supply chain securityThierry Abaléa · Devoxx France 2026
• 42mProtecting Your GitHub from Supply Chain AttacksBret Fisher · Accelerate Chicago 2026