Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
2026-05-19T07:24:05Z•dc5728586ff47986b87bbbdffd2964e8604536a621f4be89d03a5cad09612edf
active-exploitationci/cdcisa-kevcisco-sd-wancredential-theftcvedeveloper-workstationsexchange-serverfunnel-buildergithub-actionsivantimalicious-packagesmini-shai-huludminiplasmanginxnode-ipcnpmpraisonaiprivilege-escalationrcesupply-chaintanstacktoken-theftweb-skimmingwindows-zero-day
What happened
Multiple high-impact incidents and active-exploitation trends across the software supply chain and enterprise infrastructure. Key themes: supply-chain compromise (GitHub Actions tags repointed to imposter commits to steal CI/CD credentials; Mini Shai‑Hulud campaign compromising npm/@antv and TanStack; several malicious npm packages including node-ipc/other clones delivering stealers and worms), credential and token theft (Grafana GitHub token breach, developer workstation/CI secrets targeted), and multiple high-severity vulnerabilities being actively exploited (Cisco Catalyst SD‑WAN auth-bypas
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- dc5728586ff47986b87bbbdffd2964e8604536a621f4be89d03a5cad09612edf
- Enrichment time
- 2026-05-19T07:24:05Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.