Awesome CI/CD Attacks — Project Awesome

Techniques

A tool that can reveal deleted GitLab commits that potentially contain sensitive information and are not accessible via the public Git history.

Publicly Exposed Sensitive Data

Hidden GitHub Commits and How to Reveal Them

A tool that can reveal deleted GitHub commits that potentially contain sensitive information and are not accessible via the public Git history.

Initial Code Execution

ActionsTOCTOU (Time Of Check to Time Of Use) 36 updated 3mo ago

A tool to monitor for an approval event and then quickly replace a file in the PR head with a local file specified as a parameter.

Security alert: social engineering campaign targets technology industry employees

Phishing GitHub users to download and execute repositories.

Post Exploitation

Living off the pipeline 150 updated 22d ago

Inventory how development tools (typically CLIs), have lesser-known RCE-By-Design features.

Defense Evasion

PR sneaking 11 updated 9y ago

Methods of sneaking malicious code into GitHub pull requests.

One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images

A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.

Zuckerpunch - Abusing Self Hosted GitHub Runners at Facebook

Hide commits in a GitHub PR.

One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images

A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.

Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows

GitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts.

Zuckerpunch - Abusing Self Hosted GitHub Runners at Facebook

Hide commits in a GitHub PR.

One Supply Chain Attack to Rule Them All – Poisoning GitHub's Runner Images

A critical vulnerability in GitHub Actions, involving a misconfigured self-hosted runner in the actions/runner-images repository, allowed potential compromise of all GitHub and Azure hosted runner images.

Zuckerpunch - Abusing Self Hosted GitHub Runners at Facebook

Hide commits in a GitHub PR.