Poisoned Pipeline / Platforms / GitHub Actions
GitHub Actions
33 mapped incident(s) that touched this platform or registry.
Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
12 mapped techniques
tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
npmGit / GitHubGitHub ActionsDeveloper workstationAI coding agentsVS Code / IDELinux distro / packagesWindows software
11 mapped techniques
@subql/common 5.8.3 published after a CI artifact swap
npmGitHub ActionsGit / GitHubCI/CD SaaSDeveloper workstationLinux distro / packages
8 mapped techniques
GhostAction steals CI secrets, then autoruns a stealer from a fake font
Git / GitHubGitHub ActionsVS Code / IDEDeveloper workstation
16 mapped techniques
GlassWorm-hijacked contributor replaced OVHcloud CLI release assets on five published versions
Git / GitHubGitHub ActionsDeveloper workstationmacOS softwareLinux distro / packagesWindows software
6 mapped techniques
testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
npmPyPIRubyGemsGit / GitHubGitLabGitHub ActionsDeveloper workstationAI coding agentsMCPVS Code / IDELinux distro / packagesmacOS softwareWindows software
10 mapped techniques
LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
PyPIDocker / containersGit / GitHubGitHub ActionsDeveloper workstationLinux distro / packagesmacOS softwareWindows software
12 mapped techniques
TeamPCP DUSTMAKER AI workspace poisoning
npmGitHub ActionsAI coding agentsMCPGit / GitHubVS Code / IDE
5 mapped techniques
GHAPPIER loader via @dforge-core/dforge-mcp trusted publishing
npmMCPGit / GitHubGitHub Actions
7 mapped techniques
Keyv / Cacheable ChainDrop worm
npmGitHub ActionsDeveloper workstationAI coding agentsKubernetes
8 mapped techniques
actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
Git / GitHubGitHub ActionsVS Code / IDEAI coding agents
13 mapped techniques
Nx Console VS Code 18.95.0 (GitHub internal repo theft)
VS Code / IDEGit / GitHubDeveloper workstationGitHub Actions
3 mapped techniques
TanStack Mini Shai-Hulud (CVE-2026-45321)
npmGitHub ActionsAI coding agentsVS Code / IDEDeveloper workstation
18 mapped techniques
CNCF Antrea Jenkins slash-command credential theft
Git / GitHubJenkinsGitHub Actions
6 mapped techniques
Team PCP CI/CD secrets campaign
GitHub ActionsPyPICI/CD SaaSGitLab CIAzure PipelinesJenkinsBitbucketCircleCIAzureGitLabKubernetesMCP
12 mapped techniques
kubernetes-el workflow poisoned its repo
Git / GitHubGitHub ActionsLinux distro / packages
1 mapped techniques
hackerbot-claw autonomous GitHub Actions exploitation
GitHub ActionsGit / GitHubAI coding agentsVS Code / IDE
7 mapped techniques
Sha1-Hulud: The Second Coming
npmGitHub ActionsGit / GitHubLinux distro / packagesWindows softwareDeveloper workstation
4 mapped techniques
Shai-Hulud first wave (@ctrl/tinycolor)
npmGitHub ActionsGit / GitHubAI coding agentsDeveloper workstation
6 mapped techniques
Nx s1ngularity (stolen npm token via Actions injection)
npmGitHub ActionsAI coding agentsCI/CD SaaSGit / GitHubDeveloper workstation
8 mapped techniques
Spoofed Dependabot commits and secret-stealing Actions
Git / GitHubGitHub ActionsDeveloper workstation
7 mapped techniques