The Cache That Bites Back: GitHub Actions Cache Poisoning Attacks
How attackers turn GitHub Actions' shared build cache into a supply chain weapon — real cases, attack mechanics, detection logic, and mitigations.
GitHub Actions
4 articles
Shai-Hulud One Year Later: From Stolen Tokens to Compromised CI Trust
A year of Shai-Hulud attacks shows where npm defenses stop: compromised CI jobs can abuse legitimate publishing identities. Here is where to break the chain.
Cordyceps and GitHub Actions: When CI/CD Trust Boundaries Become the Supply Chain Attack
Novee's Cordyceps research is a reminder that GitHub Actions workflows are executable attack surface, not harmless YAML. Here is how to audit the trust boundary before an outside pull request borrows maintainer authority.
Shai-Hulud: The Open-Source GitHub Actions Token Harvester That Just Went Public
TeamPCP's Shai-Hulud is a TypeScript/Bun C2 framework targeting GitHub Actions CI/CD pipelines — it steals GitHub tokens, exfiltrates via a fake git domain, and has now been open-sourced for anyone to deploy.