Fixing GitHub Email Privacy Error with 3 Easy Steps

Today GitHub announced workflow lockfiles for GitHub Actions, which closes a gap attackers have used repeatedly, from tj-actions to Trivy and more. — Some quick background — GitHub Actions is GitHub's built-in automation for building, testing, and publishing code. Each automation is a workflow, a config file in the repo. Workflows pull in actions which are reusable building blocks often published by other people, much like third-party libraries. Workflows often run with access to secrets like cloud keys and publishing tokens. — What problem does this feature address? — Workflows usually reference an action by a tag, like "v3." A tag is a label pointing to a specific version of the code, and it can be moved. If an attacker compromises a maintainer's account, they can point existing tags at malicious code. Every workflow using those tags runs it next time, with no change to its own repo. Many people first saw this in March 2025, when tj-actions/changed-files leaked workflow secrets into public build logs. Investigators traced it to another action two steps upstream. This year TeamPCP hit Aqua Security's trivy-action and setup-trivy and two Checkmarx actions. And the damage spreads. A token stolen in the Trivy attack let attackers publish malicious versions of LiteLLM, which then stole credentials from its own users. — How does the feature work? — You use a lockfile to record the exact commit each tag pointed to when you reviewed it. Your workflow still says "v3," but GitHub runs the locked commit even if the tag moves. It also covers the actions your actions depend on, which matters when the compromise starts upstream. Admins can require lockfiles across an enterprise, org, or repo. GitHub is clear that locking doesn't make a dependency safe. Lock a malicious version and you'll run it consistently. — What doesn't it fix? — The biggest campaigns this year by repo count didn't move tags. Megalodon pushed malicious workflows into 5,561 repos with weak branch protection on May 18. GhostAction used what appear to be stolen credentials to hit 772 repos from late August through September, and 346 more on October 8. The malicious code sat directly in the workflow file, so there was nothing to lock. — Who can use it? — It's in public preview (GitHub's term for beta) for Enterprise Cloud, Team, and Free plans. GitHub expanded this after the initial announcement, which is good news, since it now reaches open source maintainers as well as companies. Self-hosted Enterprise Server isn't listed and Pro aren’t listed - it’s unclear if that’s intentional or an oversight. GitHub's announcement: https://lnkd.in/gm7F9-md

GitHub just announced push attribution for commits! -- What problem does this feature address? -- GitHub's author and committer fields are plain strings supplied by whoever pushes, so anyone with write access to a repo can set them to any name and email. In an account takeover scenario, this lets an attacker who compromises a low-privilege account forge commits that look like they came from a trusted maintainer. In a PolinRider attack, it lets the malware make a tampered commit look like it was written by the maintainer whose genuine commit it replaced, rather than the infected developer whose machine pushed it. The malware also rolls the victim’s clock back so the tampered commit carries the original commit’s date. Basically, attackers can sneak past review policies and muddy audit trails. -- How's the feature work? -- GitHub now records the authenticated account that pushed each commit and shows it next to the author and committer fields. Author and committer are strings the pushing client supplies, so this adds an identity GitHub authenticates rather than one anyone can type in. So when the pusher doesn’t match the name in the author or committer fields, that mismatch now shows up right on the commit page, which is a good thing! The pushed date should help too. GitHub hasn’t said where it comes from, but there’s no field in a commit for a client to fake it, so it most likely reflects when GitHub actually received the push. On the nest-access-control commit we investigated, that would mean “committed Dec 24, 2025” sitting next to “pushed Sep 8, 2026.” There's also a new ruleset condition, "Committer must match pusher," that blocks pushes where the committer email doesn't belong to the account pushing. Keep in mind that the rule checks committer, not author, so a script can still set the committer to a PolinRider victim's own email and put a trusted maintainer's name in the author field. Further, a per-commit pusher tells you who uploaded a commit, not necessarily who force-pushed a branch to point at it. -- Who can use it? -- Access is limited to GitHub Enterprise customers who request it. That's not a big surprise, but it's disappointing since many open source maintainers and freelancers don't have access to GitHub Enterprise. In addition, we can infer that it might not work for public repos because GitHub links the new rule to push rulesets (which its docs say apply only to private and internal repos). Account takeovers and PolinRider mostly target individuals with public repos, so this is unlikely to help the most vulnerable population. -- What's still unknown? -- Whether older commits get a pusher record, who can see the pusher on public repos, and how it handles commits that don't arrive through git push, like web edits, merge button commits, Actions, and GitHub Apps. Read my guide on how to reconstruct a repo's real history: https://lnkd.in/gHFHJgHT GitHub's announcement: https://lnkd.in/gyX42CiN

Two hijacked maintainer accounts were enough to compromise 346 GitHub repositories. Problem The GhostAction campaign turned two stolen maintainer accounts into a mass repository compromise. Attackers used henrywoo and kitao to inject a fake workflow file: .github/workflows/security-audit.yml. It arrived through commits named "Add security audit workflow" and "Update security audit workflow" — routine enough to pass a quick glance. The blast radius went far beyond two personal accounts. Write access to a maintainer means write access to every repository that account can modify. Targets include Uber's uber/athenadriver and kitao/pyxel, a project with more than 18,000 GitHub stars. Socket counted 318 repositories under the henrywoo namespace, including 279 forks, plus 27 under kitao. Agitation The workflow runs automatically the moment a developer pushes code. No phishing click required. Stolen data leaves as an HTTP POST to 193.32.204.199, carrying the CI/CD secrets your existing project workflows already reference. - PyPI passwords and crates.io tokens - GitHub personal access tokens - Package publishing credentials The newest variant sets fetch-depth: 0 and pulls the complete repository history, then searches active files, old commits, branches, and tags for hardcoded secrets. Deleting a key from a current file fixes nothing if it still lives in a commit from three years ago. The payload hunts AWS access key IDs and secret keys, session tokens, GitHub and GitLab tokens, Google API keys, Slack and SendGrid credentials, and API keys for OpenAI, Anthropic, and OpenRouter. It even captures surrounding lines near AWS key IDs to locate the matching secret. This was automated, not hand-picked. Commits hit repositories dormant for years, pushed in short bursts across 346 repos. Earlier GhostAction waves stole at least 3,325 secrets from 817 repositories, then reached 772 more. The real risk sits downstream: stolen PyPI, npm, Docker Hub, or crates.io tokens let an attacker publish a poisoned update from a trusted open-source project straight into production. Solution Removing the workflow is not remediation. Treat any successful run as full credential exposure. - Revoke GitHub sessions, personal access tokens, OAuth grants, and SSH keys - Rotate every secret named in the malicious workflow - Scan the entire Git history, not just the working tree - Review GitHub Actions run records and package release history - Search network logs for traffic to 193.32.204.199 - Enforce secret scanning with push protection - Require strict branch rules for any change to .github/workflows/ - Apply least-privilege permissions to every workflow How is your team securing your infrastructure against this type of exploitation? Let’s discuss in the comments below. #GhostAction #GitHubActions #SupplyChainAttack Full Article: https://lnkd.in/ePsDGCWD

For years, I've argued about how hard it is for open source maintainers to handle security reports. Today I want to give credit where it's due: GitHub just shipped a whole batch of updates to private vulnerability reporting and security advisories, and it directly addresses the pain points maintainers have been raising for a while. In two days, they landed: 1. Structured forms for private vulnerability reports. No more anonymous free-text dumps. Reporters now fill in summary, details, proof of concept (minimum 150 characters), and impact. You can customize the form with a `.github/VULNERABILITY_REPORT.yml` file, require a CWE assignment, and even let reporters disclose that they used AI assistance. Anyone who has triaged a flood of low-quality or AI-generated reports knows how much this helps separate signal from noise. 2. Rate limits for private vulnerability reports. Bulk and automated submissions were burying the reports that actually mattered. Daily per-user caps, a custom repo limit, and an allow list for trusted reporters mean legitimate researchers still reach you while the spam gets throttled. 3. Confidential comments on repository security advisories. This one is personal for me. You can now post comments visible only to maintainers, so you can discuss abuse, investigation details, and coordination without the reporter seeing everything. It's marked in the timeline, follows repository permissions, and is audit-logged. No more moving sensitive discussion to another tool and losing it from the advisory's history. 4. A REST API for advisory comments, in public preview. The triage discussion used to live only in the web UI. Now you can list, get, add, and edit comments programmatically, plus see comment counts on advisory responses. Now I can fully automate my response flow... to fight the horde. 5. New fields in the SecurityAdvisory GraphQL API: `cveId`, `sourceCodeLocation`, `githubReviewedAt`, `nvdPublishedAt`, and `repositoryAdvisoryUrl`, plus `severities` and `isWithdrawn` filters. Fewer round trips, one authentication path, one rate limit budget for integrations. Severity-based triage feeds and tracking how fast advisories move from NVD to GitHub review just got much easier. You know that I'm not one to hand out praise lightly: I've spent my share of time complaining about the incentive structures around security in open source. But this batch of changes is thoughtful and maintainer-first. It makes reporting better structured, the inbox saner, and the private coordination we need actually possible. Thank you, GitHub. This is exactly the kind of investment in the OSS security ecosystem that matters. If you maintain a public repository, enable private vulnerability reporting and give these a spin.

A "Security Audit" workflow just stole secrets from hundreds of GitHub repos. It even read the secrets people deleted years ago. The GhostAction campaign is back. On 8 October, two compromised maintainer accounts pushed a file called security-audit.yml straight to the default branch of 345+ repos in minutes, including uber/athenadriver and the 18k-star pyxel game engine. No pull request, no review, and every commit carried the maintainer's real identity. Socket now counts 500+ compromised accounts since 7 October. What the workflow does: 🔹 Sends the repo's named Actions secrets (for pyxel: PyPI, crates.io and a GitHub PAT) 🔹 Checks out with fetch-depth: 0, then runs git log -p --all to grep the entire history for AWS, GitHub, GitLab, Slack, SendGrid, Google and AI-provider keys 🔹 Pairs AWS key IDs with the secret key sitting on the next line 🔹 POSTs it all over plain HTTP to a raw IP, so DNS-based controls never see it The part that stuck with me: the GITHUB_TOKEN in the Uber run was already contents: read. Least privilege on the token didn't help, because the prize was the secrets. What I'd do this week: 1️⃣ Search your org for "193.32.204.199", "AKIA_CTX_START" and security-audit.yml / github_actions_security.yml in .github/workflows, on every branch and fork 2️⃣ Run a history secret scan (gitleaks or trufflehog over the full history) and rotate anything that was ever committed. Deleting it from HEAD doesn't count 3️⃣ Require PR review for .github/workflows and block direct pushes to the default branch, admins included 4️⃣ Put publishing and deploy secrets in an environment with required reviewers, not in plain repo secrets 5️⃣ Allowlist runner egress. One repo in this wave was saved only because its runs stalled at "approval required" 6️⃣ Treat a maintainer token as a production credential: fine-grained, short-lived, phishing-resistant MFA Your git history is part of your attack surface. Scan it like it's production. Sources: StepSecurity: https://lnkd.in/evesY4Bs Socket: https://lnkd.in/energrP3 The Hacker News: https://lnkd.in/e7gKqagZ #DevSecOps #GitHubActions #SupplyChainSecurity #CICD #SecretsManagement #CloudSecurity

Supply chain integrity is under direct assault again, with a sophisticated campaign leveraging compromised GitHub maintainer accounts to inject malicious Actions workflows across hundreds of repositories. This campaign is a stark reminder that even foundational elements of our software supply chain are targets. Researchers have identified a widespread credential-theft operation, exploiting the implicit trust in open-source maintainers by compromising their GitHub accounts. The chosen vector – GitHub Actions workflows – provides attackers direct access to build environments and, critically, the secrets configured within them. The scale is concerning, with over 340 repositories already identified as having received these malicious workflow injections. The compromise of high-profile maintainers, such as the author of the pyxel game engine, amplifies the potential blast radius. While specific payloads are still under analysis, the primary objective appears to be the exfiltration of credentials and tokens often exposed to CI/CD pipelines, posing a direct threat to downstream projects and integrated cloud services. This elevates the risk from mere code integrity to direct operational compromise. Key Technical Takeaways: * **TTPs**: Account takeover (ATO) of trusted open-source maintainer GitHub accounts. Subsequent unauthorized commit and push of malicious `.github/workflows/*.yml` files. Implicit trust in maintainer identities is the key exploit vector. * **Affected Components**: GitHub repositories integrated with GitHub Actions. Downstream applications and services relying on these compromised repositories, particularly during their own build processes if they consume artifacts from affected versions. * **Assumed Threat (Payload)**: The "malicious workflow" is highly likely designed to exfiltrate GitHub Personal Access Tokens (PATs), cloud provider credentials (AWS, GCP, Azure), or other API keys exposed as environment variables or secrets within the CI/CD runtime. (Further verification needed on specific exfiltration methods). * **Defensive Control: Maintainer Account Security**: Implement mandatory strong 2FA (hardware tokens/WebAuthn where possible) for all repository maintainers, especially those with push access to critical branches or workflow configurations. Review all GitHub Apps and authorized OAuth applications. * **Defensive Control: CI/CD Pipeline Hardening**: Enforce least privilege for all CI/CD tokens and secrets. Adopt OpenID Connect (OIDC) for ephemeral credential issuance to cloud providers instead of long-lived static keys. Audit workflow permissions to restrict unnecessary access. * **Defensive Control: Repository & Workflow Auditing**: Implement automated scanning for anomalous changes in `.github/workflows/` directories. Monitor GitHub audit logs for unexpected commits from trusted accounts, unusual branch protections modifications, or suspicious GITHUB_TOKEN usage patterns. * **Defensive Control: Dependency Verification**: Utilize supply chain security tools (e.g., OpenSSF Scorecard, SLSA attestations) to continuously monitor the integrity and trust of upstream dependencies, especially for projects consuming untagged releases or `HEAD` branches. Given this persistent threat model, how are organizations re-evaluating their trust boundaries for open-source dependencies and their maintainers? What specific controls are you implementing to detect and prevent workflow injection attacks within your CI/CD pipelines, beyond standard code reviews? How do we balance the agility of CI/CD with the imperative for absolute supply chain security? #Cybersecurity #SupplyChainSecurity #GitHubActions #CI/CD #DevSecOps #OpenSourceSecurity #CredentialTheft #ThreatIntelligence #SecurityLeadership

GitHub isn't a storage system, it's the distribution channel for every dependency your organization runs, and it just got weaponized. 500 GitHub accounts compromised and tens of thousands of repositories infected. Malicious workflows running in your CI/CD pipeline right now, the attacker doesn't need access to your code anymore but they have access to your build process. Henry Wu's account, the original author of Uber's athenadriver was hijacked on October 7. In just 16 minutes, attackers pushed malicious workflows to 318 repositories using one account. Extrapolate that across 500 compromised developer accounts and you're looking at tens of thousands of repositories now infected with persistent code execution running inside legitimate build pipelines. Here's what makes this existential. This isn't a data breach, this isn't code theft, instead this is weaponization of your build system. When a developer pulls a compromised dependency, a malicious workflow executes automatically with the same permissions as your legitimate CI/CD. An attacker inside your build pipeline can: Steal your environment variables (API keys, database credentials, authentication tokens) Inject backdoors into your compiled artifacts that ship to production Modify your code before deployment without leaving forensic traces Compromise every organization downstream that pulls your package You're not just vulnerable, you're a vector for downstream attacks. Supply chain attacks have evolved from theory to industrial practice but this is the moment where they become invisible. The workflows are automated and persist. They run every time CI/CD executes. An attacker compromises your repository once and the malicious code executes forever until you manually audit workflows and delete them, which you probably won't do because you don't know they're there. What makes this different from breaking into vendors is the scale. GitHub isn't one organization, it's the foundation that every developer, every organization, every enterprise depends on. What every organisation must do right now: 🔴 Assume any dependency pulled since October 7 contains malicious workflows, audit your CI/CD logs for suspicious executions immediately. 🟡 Review GitHub Actions workflows in every repository you maintain, look for unfamiliar steps, network calls, or environment variable access. 🟢 Verify integrity of build artifacts since October 7, assumed compiled binaries could contain injected backdoors. The detection window is hours. The persistence window is infinite. 500+ developer accounts. Tens of thousands of repositories. Hundreds of thousands of organisations downstream pulling infected code. The attack surface isn't GitHub. It's trust itself. GitHub Socketines Dr Iretioluwa Akerele #CyberSecurity #SourceCodeSecurity #GitHub #SupplyChainSecurity #NetworkSecurity #InfoSec #CI/CD #SoftwareSecurity #BlueTeam #NetworkEngineering

The perfect malware persistence strategy A threat actor just achieved flawless persistence without writing a single line of evasion code. They simply waited four months for someone to flip a repository switch back to the on position. In May, the Mini Shai-Hulud campaign compromised two utility GitHub Actions, including an issue-closing bot used by 15,000 repositories. The remediation was decisive, disable the repositories. For a third of the year, downstream CI runners hitting those dependencies met a blocked access error and failed safely in about two seconds. On September 16, the repositories were quietly re-enabled. The only flaw in this return to normalcy was that the release tags had never been scrubbed. Mutable tags like @v2.2.1 still pointed directly at the compromised commits from the original attack. The forensic footprint in the affected CI logs is wonderfully absurd. You can watch an action designed solely to close stale tickets suddenly take over 11 minutes to execute. If you dig into the steps, you see the workflow silently downloading and installing a full Bun JavaScript runtime from scratch, just to execute an obfuscated payload hiding inside the action path. This is where the discomfort shifts from platform administration to our own architectural negligence. As engineers, we treat mutable version tags like @v2 as if they were immutable cryptographic guarantees. They are fundamentally not. They are just digital sticky notes pointing to whatever a maintainer, or a threat actor, decides they should point to on any given Tuesday. Pinning to a tag instead of a commit SHA means your pipeline permanently delegates its security posture to a stranger's operational hygiene. If you ran these actions by tag after mid-September, you need to rotate your repository secrets immediately. Socket's autopsy of this accidental resurrection is worth your time strictly to witness the exact runner logs where a boring housekeeping bot decides it urgently needs a custom JavaScript environment. https://lnkd.in/e_ef6_3Z #DevOps #GitHubActions #SupplyChainSecurity

A stolen GitHub login is now worth more than most stolen passwords. Last week, a supply chain attack called GhostAction resurfaced, and it is a sharper version of the one that first hit in 2025. Attackers took over the accounts of two respected open source maintainers, including the author of a game engine with 18,000-plus stars, and used that trust to push a fake “security audit” workflow into hundreds of repositories in minutes. Socket’s researchers now count more than 500 compromised accounts and tens of thousands of affected repositories since October 7. The workflow does not just grab live secrets sitting in a project’s CI pipeline. It digs through the full git history, hunting for cloud, AI, and SaaS credentials that developers thought they had deleted months ago. Everything gets shipped out over plain HTTP to a single hardcoded server. No encryption, no subtlety, just volume. What makes this worth stopping on is not the code, it is the trust model it abuses. Open source runs on the assumption that a maintainer’s account is the maintainer. GitHub Actions runs on the assumption that a green checkmark means safe. GhostAction breaks both assumptions at once, and it did so through accounts belonging to people with years of credibility behind them, not throwaway bots. This should worry Africa’s developer community as much as anyone. The continent’s fintech and startup scene has built itself on exactly this kind of infrastructure: lean teams, open source packages, GitHub Actions doing the heavy lifting of deployment because nobody has budget for a dedicated security team. A payments startup in Lagos or Nairobi running the same automated pipelines as a Silicon Valley firm inherits the same exposure, often with fewer people watching for it. The uncomfortable part is that “we deleted the key” is not the same as “the key is safe.” If it ever touched a commit, it is still there in history, waiting for someone to go looking. Rotate your secrets properly. Audit your workflow files. And stop assuming that because a repository looks maintained, it is being watched. https://lnkd.in/ddBcD-UM

A file called security-audit.yml just landed in about 28,000 GitHub repositories. It wasn't a security audit. No zero-day, no bug in GitHub Actions. Roughly 1,900 hijacked accounts (StepSecurity points to personal access tokens from credential dumps) and workflows named like normal security jobs. The clever part: the jobs checked out the repo with fetch-depth: 0 and scanned the whole git history for AWS keys, GitHub tokens, OpenAI and Anthropic API keys. Including the ones someone "removed" from the code months ago. What I'm taking from it: - A deleted secret is not a rotated secret. If it was ever committed, it's still in history. - The token that can edit .github/workflows is the key to your CI. Fine-grained PATs, short expiry, no workflow scope unless you really need it. - Watch where your runners connect. A build job sending HTTP to an unknown IP is one of the cheapest signals to alert on. I worked on runtime detection for GitHub runners, and egress is where this kind of attack is easiest to see. And since someone always asks: would pinning actions by SHA have stopped this? No. The attackers wrote the workflow themselves. But pin anyway. In the tj-actions/changed-files attack (March 2025), a stolen bot token was used to move existing version tags to a malicious commit, and 23,000+ repos pulled it on their next run. A tag is a pointer anyone with write access can move. A SHA is the code itself. GitHub can now enforce SHA pinning in the allowed actions policy, and Dependabot keeps pinned SHAs updated. Article and analyses in the first comment. When did you last rotate a key you "removed" from a repo?