Is My (Open Source) Project Safe?
summary
Scans of 30,000 repos identify 7,000 using GitHub Actions and a followup analysis of those 7,000 shows concrete exploit chains. Techniques demonstrated include repojacking, npm email hijacking and command injection, plus abusing pull request workflow approvals to exfiltrate secrets. One compromised action allows pivoting to 18 intermediate actions and then to 72 target repos; a single Veracode action reaches ~1,600 public repos and a downstream package had ~10,000 downloads. All findings are responsibly disclosed.
AI-written summary · about
chapters (12)
- 0:00Open source safety intro
- 1:07GitHub Actions attack vectors
- 3:11Repo jacking risks
- 4:13NPM email hijacking
- 5:20Command injection via GitHub Actions
- 7:07Malicious PR workflows
- 9:14Reverse shell in runners
- 10:59Exploiting GitHub tokens
- 12:05Root access on runners
- 12:47Dependency chain attacks
- 13:47Worm attack demo
- 15:12Securing repositories
related talks
32mHacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?
23mBreaking the Build: How Attackers Abuse GitHub Actions
55mGitHub Actions: Vulnerabilities, Attacks, And Counter-Measures
21mSupply Chain Attacks on Open Source: What's Happening, What...
47mUnder the Radar: How we found 0-days in the Build Pipeline of OSS Packages
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
28mPwning the CI (with GitHub Action Workflows)
36mGithub Actions Security Landscape