It's wild to me that people entrust a third-party CI system with API secrets, and then also entrust that same system to run "actions" provided by other third parties.
the CI system itself encourages you to import random third party code into your CI workflow, based on mutable tags
which then receives full privileges
the entire thing is insane
so very few use it
it's not made obvious that the tag isn't immutable
although you might be happy with the contents of what you've imported right now, who says it won't be malicious in a year's time
people inadvertently give full control of their build and all their secrets to whoever controls that repository (now, and in the future)
making it easy to do the right thing is an important part of API design and building secure systems, and these CI systems fail miserably there
https://github.blog/changelog/2025-08-26-releases-now-suppor...
sigstore's main design goal seems to be to increase the lock-in of of "trusted" providers
(the idea that Microsoft should be trusted for anything requiring any level of security is entirely ludicrous)
https://socket.dev/blog/pypi-package-disguised-as-instagram-...
https://socket.dev/blog/monkey-patched-pypi-packages-steal-s...
https://socket.dev/blog/malicious-pypi-package-targets-disco...
https://socket.dev/blog/typosquatting-on-pypi-malicious-pack...
I’m also glad to see yet another case where having Trusted Publishing configured would have prevented the attack. That’s a cheap defense that has proven effective once again!
However, exfiltrating a token is much more easy than modifying the workflow itself. A token is usually simply stored in an env variable.
In the specific case of the attack described in the blog post, though, the attackers added an extra GitHub Actions workflow that sent the token to an external server. That means they had enough privileges to change GHA workflows, and could just as easily change a workflow that used Trusted Publishing.
(It may be possible to configure branch protections or rules limiting who/when can trigger the Trusted Publishing workflow, but it's about as difficult as limiting the secret tokens to only be available to some maintainers.)
miketheman•4mo ago