Date: October 10, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Supply Chain Security / Cloud Security / CI/CD Pipeline Attacks / Secret Harvesting
Tags: GitHub Actions, CI/CD, Supply Chain Attack, Cloud Secrets, PyPI, NPM, The Hacker News, GitWorm
Executive Summary
On October 9–10, 2026, cybersecurity researchers disclosed an automated software supply chain operation, covered extensively by The Hacker News and Western Illinois University Cyber Center, that planted credential-harvesting GitHub Actions workflows across tens of thousands of open-source and enterprise repositories.
Tracked by researchers as GitWorm, the threat actors deployed automated bot armies to submit weaponized Pull Requests containing modified .github/workflows/ YAML definitions. By exploiting architectural misconfigurations in GitHub Actions—specifically the high-privilege pull_request_target trigger—the malicious workflows executed within the security context of the target repository's base branch. This allowed the attackers to extract stored repository secrets, AWS and GCP cloud infrastructure credentials, and automated package publishing tokens (NPM and PyPI API keys) directly to attacker-controlled command-and-control servers without ever requiring the Pull Request to be merged.
Deep-Dive Technical Breakdown of the GitWorm CI/CD Exploitation Chain
The attack exploits a structural permission gap between public repository collaboration and automated CI/CD runners:
1. The Weaponization of pull_request_target
In GitHub Actions, workflows triggered by the standard pull_request event run with read-only permissions and do not have access to repository secrets:
* The Architectural Vulnerability: To enable automated workflows that label pull requests or post bot comments, repository maintainers frequently configure workflows to trigger on pull_request_target.
* The Critical Security Flaw: Workflows triggered by pull_request_target execute in the context of the repository's default branch (main or master) and inherit full read access to repository secrets and a read/write GITHUB_TOKEN.
* The Checkout Trap: When a pull_request_target workflow includes a step that checks out the pull request's untrusted head branch (e.g., actions/checkout with ref: ${{ github.event.pull_request.head.sha }}) and executes build scripts (such as npm test or make), the workflow executes the untrusted code submitted by the external attacker while possessing full access to production secrets.
2. Automated Mass Probing and Secret Exfiltration
The GitWorm operators automated the reconnaissance and exploitation lifecycle:
* Automated Bot Submission: The attackers deployed bot networks that scanned GitHub for public repositories containing pull_request_target triggers combined with untrusted checkout steps.
* The Payload Pull Request: The bots generated automated, seemingly benign Pull Requests proposing minor documentation fixes, typo corrections, or dependency version bumps.
* Secret Harvesting Execution: Hidden within the PR's test configuration or build scripts was a lightweight obfuscated Bash payload:
* The script iterated through the GitHub runner's environment variables (env), extracting all injected secrets (including AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, NPM_TOKEN, and DOCKER_PASSWORD).
* The harvested credentials were base64-encoded and transmitted via HTTPS POST requests to external Webhook listeners and Discord channels.
3. Downstream Supply Chain Poisoning
The ultimate objective of the campaign was acquiring upstream package registry access:
* Package Publishing Tokens: With valid NPM and PyPI API tokens harvested from CI/CD runners, the attackers achieved the ability to publish trojanized package updates to popular open-source packages without compromising developer workstations.
* Cloud Infrastructure Ingress: Stolen cloud IAM credentials granted adversaries persistent access to AWS S3 buckets, production Kubernetes clusters, and corporate cloud infrastructure.
Attack Dimension
Technical Detail
Campaign Identifier
GitWorm CI/CD Supply Chain Harvest
Target Infrastructure
GitHub Actions Automated Build Pipelines
Exploited Mechanism
Misconfigured pull_request_target triggers combined with untrusted code checkout
Targeted Secrets
GitHub Tokens, AWS/GCP IAM Keys, NPM/PyPI API Publishing Tokens
Scale of Campaign
Over 30,000 repositories targeted via automated bot Pull Requests
Investigative Source
The Hacker News & Threat Research Monitors
The Structural Danger of CI/CD Runner Over-Privilege
The GitWorm campaign exposes a persistent blindspot in modern DevSecOps:
* Code Review Bypassed: Security teams assume that malicious code cannot enter production until a senior engineer reviews and merges the Pull Request. However, pull_request_target triggers execute the attacker's code before any human review occurs.
* Privilege Proliferation: Repository secrets are frequently configured with organization-wide scopes rather than restricted to specific deployment environments, amplifying the blast radius of a single runner compromise.
Recommendations and Mitigations
Development teams and engineering leaders managing GitHub repositories must enforce the following controls immediately:
1. Eliminate Untrusted Checkouts in pull_request_target Workflows:
* Never check out or execute untrusted code from pull request forks within a workflow triggered by pull_request_target.
* Separate workflows: use pull_request (read-only, no secrets) for building and testing untrusted code, and use separate event triggers for privileged deployment tasks.
2. Audit and Rotate Repository Secrets:
* Immediately inspect repository secret usage logs and rotate any cloud IAM credentials, NPM tokens, or PyPI keys that were accessible to CI/CD runners during the campaign.
3. Enforce GitHub Actions Environment Protection Rules:
* Restrict access to production secrets so they are accessible only within protected GitHub "Environments" that require explicit human approval before a workflow can access them.
4. Deploy Automated Workflow Security Scanners:
* Implement automated CI/CD security linters (such as GitHub's native Dependabot secret scanning, OpenSSF Scorecard, and zizmor) to automatically flag risky workflow triggers across codebases.