corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a08720-17b5-72a9-8c95-fd73e7d3cbdd

The Monsters in Your Build Cache - GitHub Actions Cache Poisoning

adnanthekhan.com · published 6 May 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at adnanthekhan.com Wayback capture
6blogs citing
First cited
17 May 2025
Most recent
28 Jul 2026
Rank this month
not ranked
Links from this post
27
Words captured
6,622

Cited by

Blog
In the post
Date
neciudan.dev
Frontend CI/CD in the age of AI -- Part 1 Read at the source ↗
28 Jul 2026
neciudan.dev
GitHub Actions Cache Poisoning is eating open source Read at the source ↗
17 May 2026
TanStack Blog
Postmortem: TanStack npm supply-chain compromise Read at the source ↗
11 May 2026
Snyk
TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack Read at the source ↗
11 May 2026
astral.sh
Open source security at Astral Read at the source ↗
8 Apr 2026
blog.kammel.dev
Comparison of GitHub Action Scanners Read at the source ↗
17 May 2025
datosh.github.io
Comparison of GitHub Action Scanners Read at the source ↗
17 May 2025

Links from this post

Link
Host
https://github.com/adnaneKhan/cacheract
github.com
https://github.com/mdn/content
github.com
https://github.com/google/temporian/
github.com
https://github.com/chainguard-dev/terraform-provider-cosign
github.com
https://angular.dev/
angular.dev
https://scribesecurity.com/blog/github-cache-poisoning/
scribesecurity.com
https://github.com/actions/toolkit
github.com
https://github.com/actions/toolkit/blob/main/packages/cache/src/cache.ts
github.com
https://github.com/actions/toolkit/
github.com
https://github.com/actions/toolkit/blob/main/packages/cache/src/internal/tar.ts
github.com
https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
securitylab.github.com
https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
docs.github.com
https://boostsecurityio.github.io/lotp
boostsecurityio.github.io
https://api.github.com/repos/angular/angular/actions/caches?ref=refs/heads/main
api.github.com
https://github.com/angular/angular/pull/54781/files
github.com
https://github.com/actions/setup-go
github.com
https://github.com/AdnaneKhan/ActionsCacheBlasting/releases
github.com
https://github.com/AdnaneKhan/ActionsCacheBlasting/attestations/792160
github.com
https://github.com/AdnaneKhan/ActionsCacheBlasting/attestations/792161
github.com
https://slsa.dev/spec/v1.0/requirements
slsa.dev
https://github.com/angular/components/commit/f71fe2072df1ba671e10a550925c8819a4138dd1
github.com
https://developer.mozilla.org/en-US/
developer.mozilla.org
https://github.com/mdn/content/commit/12d06723f428f21fb855e13cf392dc61a7225eb7
github.com
https://github.com/google/temporian/commit/6fa5ce2b1b46bdfa382f45482b8bb29a6592cbaf
github.com
https://github.com/chainguard-dev/terraform-provider-cosign/commit/a0ed6d345b5dc45636f9bbc060de4ef60483f87e
github.com
https://github.com/AdnaneKhan/ActionsCacheBlasting
github.com
https://github.blog/changelog/2024-05-02-artifact-attestations-public-beta/
github.blog