AI
Script Injection Through Untrusted Input
Palm opened with a live demo. He created a GitHub issue, then changed the title to inject a bash command. The workflow read the title directly into a shell without sanitization. It executed the command and printed the repository secret. Two files appeared on the main branch. The same pattern applies to issue bodies, pull request comments, and branch names. The fix: funnel user input through an environment variable instead of concatenating it into a shell command.
Mutable Tags and Third-Party Action Risks
Most GitHub Actions use mutable Git tags for versioning. An attacker who gains access to the repository can move a tag to a malicious commit. The TD action attack did exactly this, redirecting all v45 references to a compromised version that exfiltrated secrets from workflow logs. The defense: pin actions by Git SHA, not by tag. Dependabot can manage SHA updates automatically. Palm also warned against pulling complex actions for trivial tasks, citing a JSON query action with 50 transitive dependencies.
Pull Request Target: Forked Code in a Trusted Context
The pull request target event runs proposed fork changes in the trusted repository’s context with access to secrets. The Shahulu attack exploited this. Script injection via pull request target, then NPM post-install scripts stole tokens and published malicious versions. In two days, 700 NPM packages were infected. The worm used stolen PAT tokens to create remote code execution endpoints and ran TruffleHog to find more secrets. GitHub hardened this on December 8th. Attacks resumed the following week.
Token Scoping and OIDC for Minimal Privilege
The default GitHub token is read-write and injected into every job. Palm recommended setting permissions to none at the workflow level and granting only what each job needs. For cloud deployments, long-lived secrets should be replaced with OIDC. OIDC creates a trust relationship between GitHub and the cloud provider, generating a short-lived token per run. Wildcard trust relationships at the organization level are dangerous: anyone in the org can assume that role. Use repository-level conditions and specific branch filters.
Automated Hardening with Thismore
Palm demoed Thismore, an open-source workflow scanner. He added a Thismore workflow to a sample repository. It flagged unpinned actions, missing concurrency limits, and overly broad permissions. After pinning actions to SHA, setting permissions to none, and adding concurrency, the pipeline passed. Thismore also validates that SHA comments match the actual version. Palm showed a GitHub Copilot skill that automates the same hardening steps. He recommended also using OpenSSF Scorecard and GitHub Attestation for signing artifacts.
Notable Quotes
Can you imagine that you have a Trojan horse in all the Linux servers that running our full internet in the world? Niek Palm · ▶ Watch (4:12)
So, enough about the pull request target. If if you don’t understand it, don’t use it. Niek Palm · ▶ Watch (21:15)
if you look how it was well done. I think they still missed a couple of things, but I would say props for those attackers. Niek Palm · ▶ Watch (29:41)
I think in 2 days 700 NPM packages were uh malicious Niek Palm · ▶ Watch (31:04)
Key Takeaways
- Pin all GitHub Actions to immutable Git SHAs, not mutable tags.
- Never pass user input directly into shell commands; use environment variables.
- Use OIDC for cloud authentication instead of long-lived secrets.
About the Speaker(s)
Niek Palm is a Principal Engineer in the Philips Software Center of Excellence. He supports businesses in the goal of building better software and engineering practices. Niek is closely involved in shaping the future of software within Philips by driving DevOps culture transformation. He is playing a key role in driving the InnerSource community in Philips to build faster, better software together. As public speaker, blogger, open source maintainer and book reviewer, he advocates and shares his expertise on key areas as Cloud, DevOps and Software Development.