A GitHub Action You Use Was Hijacked. Bump the Tag and Move On?
A third-party scanner action your repos pin by tag was hijacked for half a day. A teammate bumped the tag and wants to close the ticket. Defend what you do.
CI/CD
Security
GitAnswer key reviewed by Branko Petric
Read first: Secrets and Security in GitHub Actions
Your decision
A popular third-party scanner action had its version tags moved to a malicious commit for about twelve hours. Your org references it as @v2 in around 40 repos, and scheduled jobs ran during that window. A teammate opened PRs bumping to the maintainer's new safe tag and wants to close the ticket because the logs look normal. Do you agree, and what do you do?
The situation
A widely used third-party GitHub Action that runs a security scanner was compromised. For roughly twelve hours its version tags, including v2, pointed at a malicious commit before the maintainer noticed, restored the code and published a new release with an advisory. Your org references the action as @v2 in about 40 repositories.
Context
Several scheduled workflows ran the action inside the window, all on GitHub-hosted runners. Those jobs had access to a container registry push token, an npm publish token, a cloud deploy role assumed through OIDC, and a GITHUB_TOKEN with write permissions. Some of the repos are public. A teammate has opened PRs moving every repo to the maintainer's new release tag, skimmed a few run logs from the window, and wants to close the ticket because the logs look normal.