Record · corpus.blog/posts/01a1020c-7550-702b-b1ea-adbeadaafdaf

CodeQLEAKED – Public Secrets Exposure Leads to Supply Chain Attack on GitHub CodeQL

Praetorian · published 26 March 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at praetorian.com Wayback capture

2blogs citing

First cited: 26 Mar 2025
Most recent: 6 May 2025
Rank this month: not ranked
External links: 28
Words captured: 3,353

Cited by

Blog

In the post

Date

johnstawinski.com

Agent of Chaos: Hijacking NodeJS’s Jenkins Agents Read at the source ↗

6 May 2025

johnstawinski.com

Talks – John Stawinski IV Read at the source ↗

6 May 2025

Selected Posts | ashishb.net

Continuous integration ≠ Continuous delivery Read at the source ↗

5 Apr 2025

johnstawinski.com

CodeQLEAKED – Public Secrets Exposure Leads to Supply Chain Attack on GitHub CodeQL Read at the source ↗

26 Mar 2025

Links from this post

Link

Host

https://github.com/advisories/GHSA-vqf5-2xx6-9wfm

github.com

https://johnstawinski.com/wp-content/uploads/2024/08/us24-khan-stawinski-self-hosted-github-cicd-runners-continuous-integration-continuous-destruction.pdf

johnstawinski.com

https://www.youtube.com/watch?v=5P7KatZBr_I

youtube.com

ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts Read at the source ↗

unit42.paloaltonetworks.com

https://github.com/praetorian-inc/noseyparker

github.com

https://github.com/praetorian-inc/gato

github.com

https://docs.github.com/en/actions/writing-workflows/quickstart

docs.github.com

https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/storing-and-sharing-data-from-a-workflow

docs.github.com

https://codeql.github.com/

codeql.github.com

https://securitylab.github.com/codeql-wall-of-fame/

securitylab.github.com

https://github.com/github/codeql-action

github.com

https://github.com/github/codeql-action/actions/runs/12901573957

github.com

https://github.com/github/codeql-action/blob/f89b8a7d5239ba6d1a0f243ead94ea9ca5775ae1/.github/workflows/debug-artifacts-failure.yml

github.com

https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token

docs.github.com

https://github.com/actions/upload-artifact

github.com

https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions

docs.github.com

Playing with Fire – How We Executed a Critical Supply Chain Attack on PyTorch Read at the source ↗

johnstawinski.com

The Monsters in Your Build Cache - GitHub Actions Cache Poisoning Read at the source ↗

adnanthekhan.com

https://github.com/AdnaneKhan/Cacheract

github.com

https://github.com/Homebrew/brew

github.com

https://github.com/angular/angular

github.com

https://github.com/grafana/grafana

github.com

Worse than SolarWinds: Three Steps to Hack Blockchains, GitHub, and ML through GitHub Actions Read at the source ↗

johnstawinski.com

https://github.com/github/codeql-action/pull/2712

github.com

https://hackerone.com/hacktivity/cve_discovery?id=CVE-2025-24362

hackerone.com

https://github.com/github/codeql-action/tree/testpoc

github.com

https://github.com/github/codeql-action/commit/26fcd8e2368067be04a705a229590749a426fefe

github.com

https://github.com/github/codeql-action/releases/tag/testpoctag

github.com

Elsewhere on praetorian.com (12)

https://www.praetorian.com/services/red-team/

praetorian.com

Phantom of the Pipeline: Abusing Self-Hosted CI/CD Runners Read at the source ↗

praetorian.com

https://www.praetorian.com/services/ci-cd-security-engagement/

praetorian.com

https://www.praetorian.com/guard

praetorian.com

From Self-Hosted GitHub Runner to Self-Hosted Backdoor Read at the source ↗

praetorian.com

TensorFlow Supply Chain Compromise via Self-Hosted Runner Attack Read at the source ↗

praetorian.com

Compromising ByteDance’s Rspack using GitHub Actions Vulnerabilities Read at the source ↗

praetorian.com

https://www.praetorian.com/resources/unpacking-codeqleaked-a-potential-supply-chain-attack-on-github-codeql/

praetorian.com

https://www.praetorian.com/guard/continuous-threat-exposure-management/

praetorian.com

http://guard.praetorian.com/

guard.praetorian.com

https://www.praetorian.com/contact-us/

praetorian.com

https://www.praetorian.com

praetorian.com