GitHub Actions Under Siege: The Alarming Rise of Supply Chain Attacks in 2025
A wave of sophisticated attacks exploiting GitHub Actions has exposed critical software supply chains, raising urgent questions about shared security responsibilities.
When Coinbase, a global cryptocurrency exchange, found nearly 70,000 of its customers affected by a breach earlier this year, the attack didn’t begin with its own code. Instead, the threat vector was a seemingly innocuous GitHub Action-a tool millions of developers rely on daily. As 2025 unfolds, cybercriminals have taken aim at the very heart of collaborative software development, exploiting misconfigurations in GitHub Actions and shaking the foundation of trust in open source ecosystems.
The Anatomy of a GitHub Supply Chain Attack
GitHub, the world’s largest code repository, is the backbone of modern software development. Its Actions feature automates critical tasks-testing, building, deploying-but it also introduces new risks. According to Amitai Cohen and Rami McCarthy of Wiz, attackers are increasingly exploiting misconfigured Actions to access sensitive data stored in code repositories.
In these attacks, criminals inject malicious code or manipulate workflows to exfiltrate secrets like GitHub Personal Access Tokens, npm tokens, and even private RSA keys. Once stolen, these credentials can be used to escalate privileges, access proprietary code, or pivot into enterprise networks. The Ultralytics and Singularity breaches are stark reminders of how a single compromised Action can ripple through the entire supply chain, affecting not just primary targets but anyone downstream.
“Everyone puts their code on GitHub and is allowed to use it for all sorts of reasons, but it can't be fully incumbent on GitHub to secure every single open source use and every pipeline,” McCarthy explains. The assumption that GitHub’s built-in security features are enough has proven dangerously optimistic; many organizations are unaware of the risks posed by inherited or third-party Actions, and optional security controls are often ignored or deprecated.
Moreover, the “bystander effect” in open source-where responsibility for security is diffused among countless contributors-means that even tech giants consuming code have little insight into its ongoing security. As the Coinbase incident shows, a vulnerability in a third-party Action can cascade, impacting thousands of organizations and end users.
Conclusion: A Call for Vigilance and Collaboration
As supply chain attacks grow in sophistication, the onus is on both providers and consumers of open source tools to step up their security game. The events of 2025 are a stark wake-up call: in today’s interconnected ecosystem, a single misconfiguration can have global consequences. It’s time for the developer community to move beyond assumptions and embrace a proactive, shared approach to securing the software supply chain.
WIKICROOK: Glossary
- Supply Chain Attack
- An attack that targets vulnerabilities in the interconnected network of software, hardware, or services relied upon by an organization, often through third-party components.
- GitHub Actions
- An automation feature in GitHub that allows developers to create workflows for building, testing, and deploying code directly from their repositories.
- Secret
- In cybersecurity, a confidential piece of data-such as an access key, token, or password-used to authenticate or authorize access to systems or services.
- Continuous Integration/Continuous Delivery (CI/CD)
- Software development practices that automate the building, testing, and deployment of applications to speed up release cycles and improve quality.
- Open Source
- Software for which the original source code is made freely available and may be redistributed and modified by anyone.
