Thinking Like a Hacker: Stealing Secrets with a Malicious GitHub Action

This page summarizes the projects mentioned and recommended in the original post on dev.to

Our great sponsors
  • InfluxDB - Power Real-Time Data Analytics at Scale
  • WorkOS - The modern identity platform for B2B SaaS
  • SaaSHub - Software Alternatives and Reviews
  • Jenkins

    Jenkins automation server

  • In this scenario, we start out with a full-stack developer at Poor Corp who is trying to get started with automatic builds and deployments using GitHub Actions. Poor Corp has a Jenkins instance that they have used in the past for automating internal jobs, so the developer decides to try using that as part of the CI/CD pipeline. They do a search for “Jenkins” in the GitHub Marketplace to get started, but there don’t seem to be any official-looking actions or apps. The developer browses through a few of the available actions provided by other developers on GitHub and chooses the first one with a helpful README. Little does our developer know; he has just fallen for a trap.

  • InfluxDB

    Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

    InfluxDB logo
NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a more popular project.

Suggest a related project

Related posts