#github-actions

[definitelytzar]

Nx Console 18.95.0 Compromised: Credential Stealer Targets 2.2M VS Code Developers

A compromised version of the Nx Console extension for VS Code has been discovered stealing credentials from over 2.2 million developers. Version 18.95.0 of the popular extension (rwl.angular-console) contained a multi-stage credential stealer that silently harvested secrets from developer workstations within seconds of opening any workspace.

The Attack Vector

The breach originated from a compromised developer machine that leaked GitHub credentials. Attackers used these credentials to push an unsigned orphan commit to the official nrwl/nx repository, introducing stealer malware that triggered immediately upon workspace initialization.

The malicious payload, a 498 KB obfuscated script, was fetched from a dangling orphan commit hidden inside the official repository. It launched as a detached background process and began harvesting credentials from:

- 1Password vaults - Anthropic Claude Code configurations - npm tokens - GitHub credentials - AWS secrets

Sigstore Integration: A Dangerous Capability

What makes this attack particularly dangerous is the payload's full Sigstore integration, including Fulcio certificate issuance and SLSA provenance generation. Combined with stolen npm OIDC tokens, attackers could publish downstream npm packages with valid, cryptographically signed provenance attestations—making malicious packages appear as legitimate, verified builds.

Indicators of Compromise

The Nx team confirmed that a "few users were compromised" during the exposure window: May 18, 2026, 2:36 PM CEST to 2:47 PM CEST (approximately 11 minutes).

Affected users should check for:

- Files: ~/.local/share/kitty/cat.py, ~/Library/LaunchAgents/com.user.kitty-monitor.plist, /var/tmp/.gh_update_state, /tmp/kitty-* - Processes: Python running cat.py or any process with __DAEMONIZED=1 in environment variables

Remediation

Developers must update to Nx Console version 18.100.0 or later immediately. If version 18.95.0 was installed during the exposure window, all credentials reachable from the affected machine must be rotated—including tokens, secrets, and SSH keys.

Reflection

This marks the second time the Nx ecosystem has been targeted within a year. In August 2025, the s1ngularity campaign infected several npm packages with credential stealers. The shift from npm packages to VS Code extensions represents an evolution in supply chain attacks: instead of waiting for a build pipeline to execute malicious code, attackers now compromise the developer's workstation directly.

The lesson is clear: developer workstations are now part of the software supply chain. Protecting them requires the same rigor as protecting CI/CD pipelines—multi-factor authentication, hardware security keys, and continuous monitoring for anomalous behavior.

[definitelytzar]

GitHub Actions Compromised: Imposter Commits Steal CI/CD Credentials

A sophisticated supply chain attack has compromised the popular actions-cool/issues-helper GitHub Action, redirecting all existing tags to imposter commits designed to steal CI/CD credentials. The attack represents a new evolution in software supply chain exploitation, bypassing traditional code review processes entirely.

The Imposter Commit Technique

Unlike traditional supply chain attacks that inject malicious code through pull requests or direct commits, this attack used "imposter commits"—deceptive references that point to malicious code existing only in an adversary-controlled fork, rather than the original trusted repository.

StepSecurity researcher Varun Sharma explained: "Every existing tag in the repository has been moved to point to an imposter commit that does not appear in the action's normal commit history. That commit contains malicious code that exfiltrates credentials from CI/CD pipelines that run the action."

How the Attack Worked

When a GitHub Actions workflow referenced the compromised action by version tag, the following sequence occurred:

- The workflow pulled the malicious commit (thinking it was legitimate) - The action downloaded the Bun JavaScript runtime to the runner - It read memory from the Runner.Worker process to extract credentials - Stolen data was exfiltrated via HTTPS to t.m-koschecom

Connection to Mini Shai-Hulud Campaign

The exfiltration domain overlaps with the Mini Shai-Hulud campaign that recently compromised @antv npm packages, suggesting both attacks are part of a coordinated operation. Philipp Burckhardt, head of threat intelligence at Socket, confirmed: "That points to the same Mini Shai-Hulud activity cluster, not a separate npm-only incident."

Scope of Compromise

In addition to issues-helper, 15 tags associated with actions-cool/maintain-one-comment were also compromised with identical functionality. GitHub has since disabled access to both repositories due to violations of its terms of service.

StepSecurity warned: "Because every tag now resolves to malicious commits, any workflow that references the action by version pulls the malicious code on its next run. Only workflows pinned to a known-good full commit SHA are unaffected."

Remediation

Organizations using these actions must:

- Immediately remove references to actions-cool/issues-helper and actions-cool/maintain-one-comment - Rotate all CI/CD credentials that may have been exposed - Pin future actions to full commit SHAs instead of version tags - Monitor outbound connections from CI/CD runners for suspicious domains

Reflection

The imposter commit technique demonstrates a fundamental weakness in how GitHub Actions resolves dependencies. Tags are mutable references that can be rewritten by anyone with write access to a repository—whether that access was obtained legitimately or through compromise.

For enterprises relying on GitHub Actions for CI/CD, the lesson is unequivocal: never trust tags. Pinning to full commit SHAs provides cryptographic assurance that the code you're running is exactly what you reviewed. Anything less is an invitation to supply chain compromise.

[iamdevbox]

Setting Up a CI/CD Pipeline to Kubernetes with GitHub Actions

🚀 New companion repo: github-actions-k8s-deploy Production GitHub Actions CI/CD pipeline for Kubernetes — the patterns most tutorials skip: ✅ Blue-green deployment with 5-minute error monitoring + auto-rollback ✅ Least-privilege RBAC (namespace-scoped, not cluster-admin) ✅ Private registry auth (ghcr.io imagePullSecret setup) ✅ Flagger Canary config for progressive traffic shifting ✅ kubeconfig generator script for CI service account Clone it: https://github.com/IAMDevBox/github-actions-k8s-deploy Full tutorial (fixing ImagePullBackOff, RBAC errors, kubeconfig issues): https://iamdevbox.com/posts/setting-up-a-cicd-pipeline-to-kubernetes-with-github-actions/ #Kubernetes #GitHubActions #CICD #DevOps #K8s #Docker #BlueGreen #IAM Read more: Setting Up a CI/CD Pipeline to Kubernetes with GitHub Actions

[iamdevbox]

Automate Your CI/CD Journey with Frodo CLI in GitHub Actions

Frodo CLI is a powerful tool that simplifies the process of exporting and importing data between GitHub and other services. When combined with GitHub Actions, you can automate your CI/CD pipeline and streamline your development workflow. In this post, we'll explore how to use Frodo CLI to automate the journey of exporting and importing data in GitHub Actions. To get started, you'll need to install Frodo CLI and set up a GitHub Actions workflow. Once you have these in place, you can use Frodo CLI to automate the process of exporting and importing data. For example, you can use Frodo CLI to export your GitHub issues and then import them into a different service. One of the key benefits of using Frodo CLI with GitHub Actions is the ability to automate repetitive tasks. By automating these tasks, you can free up more time to focus on high-level development tasks and improve your overall workflow. Read more: Automate Your CI/CD Journey with Frodo CLI in GitHub Actions