Cybersecurity articles tagged #GitHub Actions on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threathttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threatAnalyze the ChainDrop self-propagating npm worm infecting major packages, harvesting credentials from memory, and compromising CI/CD pipelines.Fri, 07 Aug 2026 02:13:34 GMTSupply Chain AttackMalwareNPMGitHub ActionsCredential Thefthttps://runtimerebel.com/blog/cloudflare-s-flue-automates-open-source-issue-triagehttps://runtimerebel.com/blog/cloudflare-s-flue-automates-open-source-issue-triageCloudflare details how its Flue framework automates Astro's GitHub issue triage, significantly reducing open issues and improving maintainer efficiency.Thu, 06 Aug 2026 10:32:27 GMTOpen SourceGitHub ActionsAI AutomationIssue TriageCloudflare Fluehttps://runtimerebel.com/blog/defending-against-the-1444-surge-in-open-source-supply-chain-attackshttps://runtimerebel.com/blog/defending-against-the-1444-surge-in-open-source-supply-chain-attacksGTIG reports a massive 1,444% spike in open source repository compromises. Learn how to mitigate threats from actors like UNC6780 and MIDNIGHT NEPTUNE.Thu, 30 Jul 2026 14:10:41 GMTUNC6780MIDNIGHT NEPTUNEOpen Source SecurityGitHub ActionsNPM Securityhttps://runtimerebel.com/blog/github-actions-runners-weaponized-to-attack-cpanel-and-whm-servershttps://runtimerebel.com/blog/github-actions-runners-weaponized-to-attack-cpanel-and-whm-serversAttackers are leveraging GitHub Actions runners and compromised Packagist packages to launch distributed attacks against cPanel and WHM server instances.Thu, 23 Jul 2026 14:05:01 GMTGitHub ActionsPackagistcPanelWHMSupply Chain AttackPHPhttps://runtimerebel.com/blog/github-actions-attack-patterns-evade-ci-security-scannershttps://runtimerebel.com/blog/github-actions-attack-patterns-evade-ci-security-scannersLearn how sophisticated GitHub Actions attack patterns bypass traditional CI security scanners, exposing CI/CD pipelines to supply chain risks.Tue, 07 Jul 2026 14:38:51 GMTGitHub ActionsCI CD SecuritySupply Chain SecuritySecurity ScanningCode Integrityhttps://runtimerebel.com/blog/cordyceps-defending-against-malicious-pull-requests-in-ci-cdhttps://runtimerebel.com/blog/cordyceps-defending-against-malicious-pull-requests-in-ci-cdThe Cordyceps campaign highlights critical CI/CD vulnerabilities in GitHub Actions, targeting high-profile projects like Apache Doris and Cloudflare Workers SDK.Wed, 24 Jun 2026 09:23:01 GMTGitHub ActionsCI CD SecuritySupply Chain AttackDevSecOpsCordycepshttps://runtimerebel.com/blog/anthropic-claude-code-github-action-flaw-enables-repo-hijackinghttps://runtimerebel.com/blog/anthropic-claude-code-github-action-flaw-enables-repo-hijackingA critical flaw in Anthropic's Claude Code GitHub Action allowed attackers to hijack public repositories using malicious issues, posing supply chain risks.Thu, 04 Jun 2026 17:08:52 GMTAnthropicClaude CodeGitHub ActionsCI CD SecurityRyotaKhttps://runtimerebel.com/blog/megalodon-supply-chain-attack-infects-5500-github-repositorieshttps://runtimerebel.com/blog/megalodon-supply-chain-attack-infects-5500-github-repositoriesAttackers used automated commits to inject malicious GitHub Actions workflows into 5,500+ repositories, targeting CI/CD secrets and sensitive tokens.Mon, 25 May 2026 09:28:56 GMTGitHubSupply Chain AttackMegalodonGitHub ActionsCredential Thefthttps://runtimerebel.com/blog/megalodon-campaign-5561-github-repos-hit-by-malicious-workflowshttps://runtimerebel.com/blog/megalodon-campaign-5561-github-repos-hit-by-malicious-workflowsAutomated Megalodon attack pushes 5,718 malicious commits to GitHub repositories to exfiltrate secrets via GitHub Actions workflows.Fri, 22 May 2026 12:58:34 GMTMegalodonGitHub ActionsCI CD SecuritySupply Chain Attackhttps://runtimerebel.com/blog/grafana-breach-after-tanstack-attack-token-rotation-failurehttps://runtimerebel.com/blog/grafana-breach-after-tanstack-attack-token-rotation-failureGrafana suffered a data breach due to a GitHub workflow token not rotated after the TanStack npm supply-chain attack, impacting user data. Learn the details.Wed, 20 May 2026 17:12:03 GMTGrafanaTanStackNPMSupply Chain AttackGitHub ActionsToken RotationData Breachhttps://runtimerebel.com/blog/github-actions-supply-chain-attack-actions-cool-issues-helperhttps://runtimerebel.com/blog/github-actions-supply-chain-attack-actions-cool-issues-helperAnalysis of the actions-cool/issues-helper supply chain attack where tags were redirected to steal credentials. Learn how to detect and mitigate this threat.Tue, 19 May 2026 09:20:28 GMTGitHub ActionsActions CoolSupply Chain AttackCredential Thefthttps://runtimerebel.com/blog/gemini-cli-critical-rce-fix-patching-the-google-gemini-cli-flawhttps://runtimerebel.com/blog/gemini-cli-critical-rce-fix-patching-the-google-gemini-cli-flawGoogle patches a CVSS 10.0 flaw in Gemini CLI tools that allowed unprivileged attackers to execute commands in CI/CD environments via malicious configurations.Thu, 30 Apr 2026 08:52:38 GMTGoogle Gemini CLIGitHub ActionsGoogle GeminiCI CD SecurityRCEhttps://runtimerebel.com/blog/openai-revokes-macos-app-certificate-following-supply-chain-attackhttps://runtimerebel.com/blog/openai-revokes-macos-app-certificate-following-supply-chain-attackOpenAI revokes its macOS app signing certificate after a GitHub Actions workflow downloaded a malicious Axios library version during a supply chain incident.Mon, 13 Apr 2026 08:48:46 GMTOpenAImacOSAxiosGitHub ActionsSupply Chain Securityhttps://runtimerebel.com/blog/axios-npm-supply-chain-attack-bypasses-github-actions-ci-cdhttps://runtimerebel.com/blog/axios-npm-supply-chain-attack-bypasses-github-actions-ci-cdA sophisticated supply chain attack targeted the Axios NPM package, leveraging a compromised token to bypass GitHub Actions CI/CD and deploy malicious versions.Wed, 01 Apr 2026 12:28:22 GMTAxiosNPMSupply Chain AttackNorth KoreaGitHub ActionsCI CDhttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-target-docker-hub-pypi-and-vs-codehttps://runtimerebel.com/blog/teampcp-supply-chain-attacks-target-docker-hub-pypi-and-vs-codeTeamPCP expands supply chain attack tactics from GitHub Actions to Docker Hub, PyPI, and VS Code extensions, collaborating with the Lapsus$ hacking group.Wed, 25 Mar 2026 12:24:38 GMTTeamPCPLapsusSupply Chain AttackDocker HubGitHub ActionsVS Codehttps://runtimerebel.com/blog/trivy-supply-chain-attack-teampcp-pushes-infostealer-via-githubhttps://runtimerebel.com/blog/trivy-supply-chain-attack-teampcp-pushes-infostealer-via-githubThreat actor TeamPCP compromised the Trivy-action repository to distribute infostealer malware through GitHub Actions, targeting CI/CD pipelines and secrets.Sat, 21 Mar 2026 20:08:15 GMTTrivy ScannerGitHub ActionsTeamPCPInfostealerCI CD Securityhttps://runtimerebel.com/blog/75-trivy-action-github-tags-hijacked-in-supply-chain-attackhttps://runtimerebel.com/blog/75-trivy-action-github-tags-hijacked-in-supply-chain-attackAttackers hijacked 75 tags in Aqua Security's Trivy GitHub Actions to exfiltrate CI/CD secrets, marking the second major breach in a single month.Fri, 20 Mar 2026 20:11:11 GMTAquasecurityTrivy ActionGitHub ActionsSupply Chain AttackSecret Thefthttps://runtimerebel.com/blog/tag-poisoning-compromises-xygeni-github-action-c2-implant-activehttps://runtimerebel.com/blog/tag-poisoning-compromises-xygeni-github-action-c2-implant-activeAttackers compromised the `xygeni/xygeni-action` GitHub Action using tag poisoning, deploying a C2 implant for up to a week. Users must verify integrity and review logs.Thu, 12 Mar 2026 00:30:26 GMTGitHub ActionsSupply Chain AttackTag PoisoningXygeniC2