Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows

0 stars0 forks0 contributors

Overview

GitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts

Related Projects

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub

Last commit

Created

Links & Resources

Website

Included in

CI/CD Attacks578

PR sneaking

A repository demonstrating how you can sneak malicious code into Github PRs

Stars11

Forks1

Last commit9 years ago

Remove evidence of malicious pull requests on GitHub

Changing account's email to block-listed domain, automatically bans the account

Stars0

Forks0

Last commit

GitHub comments abused to push malware via Microsoft repo URLs

Hidden GitHub comment link

Stars0

Forks0

Last commit

How a Single Vulnerability Can Bring Down the JavaScript Ecosystem

Cache poisoning attack on the NPM registry rendering packages unavailable

Stars0

Forks0

Last commit