Record · corpus.blog/posts/01a08720-17b6-72b1-a842-9adaa43b7222

One Supply Chain Attack to Rule Them All - Poisoning GitHub's Runner Images

adnanthekhan.com · published 20 December 2023

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at adnanthekhan.com Wayback capture

3blogs citing

First cited: 5 Jan 2024
Most recent: 16 Dec 2025
Rank this month: not ranked
External links: 28
Words captured: 5,273

Cited by

Blog

In the post

Date

johnstawinski.com

Hey. I’m John. Read at the source ↗

16 Dec 2025

johnstawinski.com

Black Hat and DEF CON Preview: “Grand Theft Actions” or “Continuous Integration, Continuous Destruction”? Read at the source ↗

30 Jul 2024

Praetorian

Compromising ByteDance’s Rspack using GitHub Actions Vulnerabilities Read at the source ↗

31 May 2024

johnstawinski.com

Fixing Typos and Breaching Microsoft’s Perimeter Read at the source ↗

15 Apr 2024

johnstawinski.com

Fixing Typos and Breaching Microsoft’s Perimeter Read at the source ↗

15 Apr 2024

ianlewis.org

Code Signing is not Enough Read at the source ↗

1 Feb 2024

Praetorian

TensorFlow Supply Chain Compromise via Self-Hosted Runner Attack Read at the source ↗

15 Jan 2024

johnstawinski.com

Playing with Fire – How We Executed a Critical Supply Chain Attack on PyTorch Read at the source ↗

11 Jan 2024

johnstawinski.com

Worse than SolarWinds: Three Steps to Hack Blockchains, GitHub, and ML through GitHub Actions Read at the source ↗

5 Jan 2024

Links from this post

Link

Host

https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners

docs.github.com

https://hackerone.com/github

hackerone.com

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

docs.github.com

https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners

docs.github.com

https://github.com/actions/checkout

github.com

https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks

docs.github.com

https://github.blog/changelog/2022-03-21-github-actions-restrict-self-hosted-runner-groups-to-specific-workflows/

github.blog

https://github.com/actions/runner-images

github.com

https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution

owasp.org

https://github.com/actions/runner-images/tree/2733b9fa28c141603991a62766425903e08601e3

github.com

https://karimrahal.com/2023/01/05/github-actions-leaking-secrets/

karimrahal.com

https://docs.github.com/en/rest/actions/self-hosted-runners?apiVersion=2022-11-28

docs.github.com

https://checkmarx.com/blog/surprise-when-dependabot-contributes-malicious-code/

checkmarx.com

https://github.com/actions/runner-images/actions/workflows/merge_pull_request.yml

github.com

John Stawinski IV Read at the source ↗

johnstawinski.com

https://github.com/actions/actions-runner-controller

github.com

https://github.com/pytorch/pytorch/

github.com

https://github.com/tensorflow/tensorflow

github.com

https://github.com/microsoft/deepspeed

github.com

https://github.com/chia-Network/chia-blockchain

github.com

https://github.com/praetorian-inc/gato

github.com

From Self-Hosted GitHub Runner to Self-Hosted Backdoor Read at the source ↗

praetorian.com

https://gist.githubusercontent.com/UncertainBadg3r/32c8fa0b13cdac6095b916a50b5bac34/raw/code

gist.githubusercontent.com

https://github.com/actions/runner-images/pull/7182

github.com

https://marcyoung.us/post/zuckerpunch/

marcyoung.us

https://github.com/nikitastupin/pwnhub

github.com

https://0xn3va.gitbook.io/cheat-sheets/ci-cd/github/actions

0xn3va.gitbook.io

https://owasp.org/www-project-top-10-ci-cd-security-risks/

owasp.org