GitHub Actions supply chain attacks: is your build runner blind?

TL;DR: GitHub Actions supply chain attacks repeatedly exploit the build runner rather than the codebase, with one March 2025 incident affecting more than 23,000 repositories and dumping secrets into logs, according to Cycode. The recurring lesson is that SHA pinning and token scoping reduce risk but do not observe runtime abuse inside the runner, where the attack actually executes.

NHIMG editorial — based on content published by Cycode: GitHub Actions Supply Chain Attacks: How They Work and How to Stop Them

Questions worth separating out

Q: What breaks when a GitHub Actions workflow component is compromised?

A: A compromised workflow component can turn CI/CD into a secret-exposure path because runner processes may hold credentials, tokens, and job data in memory during execution.

Q: Why do GitHub Actions supply chain attacks bypass normal IAM controls?

A: They bypass normal IAM controls because the most sensitive access exists inside ephemeral automation, not in a permanent user session.

Q: How do teams know if agentic CI/CD controls are actually working?

A: Look for evidence that the agent cannot reach secrets, cannot mutate protected branches, and cannot execute shell commands outside its declared boundary.

Practitioner guidance

• Harden workflow trust boundaries Restrict pull_request_target usage, review third-party actions before approval, and pin actions to immutable commit SHAs so tag repointing cannot silently change what executes in the runner.
• Monitor runner memory and process behaviour Deploy runtime controls that can detect reads of /proc/PID/mem, unexpected subprocess creation, and anomalous environment variable access inside the build runner.
• Constrain outbound egress from CI/CD jobs Allow only known endpoints for each workflow and flag any new destination, because many attacks rely on callback domains, gist fetches, or log exfiltration paths.

What's in the full article

Cycode's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step walkthrough of the tj-actions attack chain, including the stolen token, tag repointing, and log-based exfiltration path
• Specific runtime detection examples showing how eBPF blocks /proc/PID/mem access, unauthorised egress, and suspicious process creation
• Incident-by-incident breakdown of the six cases in the threat log, useful if you need deeper forensics for pipeline hardening
• Practical comparison of SHA pinning, token scoping, and runtime monitoring across different attack phases

👉 Read Cycode's analysis of GitHub Actions supply chain attacks and build runner exposure →

GitHub Actions supply chain attacks: is your build runner blind?

Explore further

View Full Forum →  |  NHI Foundation Course →