CI/CD advisories for GitHub Actions: rogue self-hosted runners, leaked workflow secrets and poisoned actions.
Prompt injection in GitHub issues let attackers reach CI secrets through Claude Code, Gemini CLI and Codex. Upgrade, and keep untrusted input away from secrets.
Poisoned TanStack packages stole an Nx developer’s GitHub token. A trojaned Nx Console release then hit GitHub and Grafana. Check installs, rotate tokens.
Poisoned Trivy and KICS actions and images, LiteLLM 1.82.7/1.82.8 and Telnyx 4.87.1/4.87.2 stole CI and developer secrets. Check, then rotate.
A self-replicating npm worm runs at install time, steals developer and CI secrets, and registers rogue GitHub runners. New waves hit from April to August 2026.
