Tag: CI/CD Credentials

Threat actors have breached the well-known GitHub Actions workflow, actions-cool/issues-helper, in yet another software supply chain attack. The compromised code harvests sensitive credentials and exfiltrates them to a site under the attacker's control. According to StepSecurity researcher Varun Sharma, every tag in the repository has been changed to point to an impostor commit that does not show up in the action's typical commit history. "Malicious code in that commit steals credentials from CI/CD pipelines that carry out the action. By referencing a commit or tag that only exists in an adversary-controlled branch rather than the original trusted repository, malicious code can be introduced into a project via an imposter commit, a dishonest software supply chain attack technique. B...