Malicious npm Package Exploits GitHub Actions Workflow to Steal Cloud Credentials
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers compromised the widely-used npm package @7nohe/openapi-react-query-codegen by exploiting a poorly scoped GitHub Actions workflow that allowed untrusted fork contributors to trigger package publishing under the legitimate repository's trusted identity. Ten malicious versions were published with valid npm provenance attestations, creating a false sense of legitimacy and bypassing common trust signals. The malicious code executed at install time, targeting high-value secrets including cloud credentials, package registry tokens, and GitHub Actions secrets — and was capable of self-propagation. This attack illustrates how CI/CD pipeline misconfigurations can be weaponized to undermine even signed, attested software supply chains.
Tactical Insight
Immediate actions
- Audit all GitHub Actions workflows for `pull_request_target` or comment-triggered events that grant write or publish permissions to untrusted contributors.
- Rotate any cloud credentials, npm tokens, and GitHub Actions secrets that may have been exposed by installing affected versions of the package.
- Pin all npm dependencies to exact, verified commit SHAs or checksums rather than mutable version tags.
Long-term improvements
- Enforce least-privilege scoping on CI/CD publishing workflows so only explicitly trusted, protected branches or maintainer-controlled events can trigger package releases.
- Implement a software composition analysis (SCA) tool in your pipeline to continuously monitor for newly flagged malicious packages in your dependency tree.
- Establish an internal package mirroring or vetting process before allowing new third-party npm packages into production builds.
Detection measures
- Monitor runtime behavior of npm install scripts using tools like Socket.dev, Snyk, or similar supply chain security platforms that flag install-time code execution.
- Set up alerting for unexpected outbound network connections originating from build or CI/CD environments, which may indicate credential exfiltration.
- Regularly review npm provenance attestations critically — treat attestation as one signal, not a sole trust indicator, and cross-reference with maintainer activity logs.