Tag: ci-cd-security

Auditing GitHub Actions for the wfx-loot Pattern: Workflow Triggers, OIDC Scope, and npm Execution

pr0h0•November 13, 2026

A technical audit guide to the wfx-loot campaign, tracing malicious GitHub Actions triggers, over-scoped OIDC cloud tokens, and npm execution paths to build detection and containment controls for CI/CD pipelines.

github-actionsci-cd-securitysupply-chain-attack

Auditing GitHub Release Workflows After the OVHcloud CLI Supply-Chain Compromise

pr0h0•October 21, 2026

An audit-focused guide to hardening GitHub release workflows after attackers hijacked five OVHcloud CLI releases to distribute secret-stealing malware.

supply-chain-securitygithub-actionsrelease-engineering

Auditing GitHub Actions for Leaked Secrets: OIDC, Least-Privilege PATs, and Audit-Log Tripwires

pr0h0•October 11, 2026

A practical audit playbook for GitHub Actions secret exposure, covering OIDC trust policies, least-privilege PATs, secret scanning, and audit-log tripwires in the wake of the GhostAction campaign that compromised 500+ accounts to steal cloud and AI API credentials.

github-actionsoidcsecrets-management