Tagged “github”
4 posts
Shai-Hulud Turns Your Own Laptop Into a GitHub Actions Runner
The Shai-Hulud npm worm backdoors developer machines by registering them as self-hosted GitHub Actions runners, then uses GitHub Discussions as its command channel.
securitygithubcicdsupplychainnpm
Ditch IAM access keys: GitHub Actions OIDC to AWS
A step-by-step guide to replacing long-lived IAM access keys in GitHub Actions with short-lived OIDC credentials, including the trust policy gotchas that bite people.
awsgithubiamtutorial
CVE-2025-30066: The GitHub Action Tag You Trusted Lied
A compromised maintainer token let attackers rewrite tj-actions/changed-files version tags, dumping CI/CD secrets from thousands of repos into public build logs.
securitycicdsupplychaingithub
Leaked credentials in public repos get used in minutes
GitGuardian logged 28.65M secrets on public GitHub in 2025, and researchers have watched leaked AWS keys get abused in under five minutes.
securitygithubsecretsappsec