March 2025 Summaries

The article, part of a series on the top 10 open-source software (OSS) risks, focuses on the risk of compromising legitimate packages, a significant concern in modern software supply chains. Legitimate packages, essential components in software development, can be compromised by attackers through various stages from development to distribution, injecting malicious code that jeopardizes system integrity and security. The piece highlights several attack vectors, such as inserting malicious code during development or build stages, exploiting maintainer roles, and manipulating version control systems, with real-world examples like the GitHub Action tj-actions/changed-files supply chain attack illustrating the potential damage. The article emphasizes the importance of proactive security measures, such as auditing dependencies, pinning versions, securing access tokens, and maintaining internal package registries, to mitigate these risks and safeguard against such compromises.

A recent analysis of the GitHub Action "tj-actions/changed-files" attack revealed that while tens of thousands of repositories use this tool, the actual impact was less severe than initially feared. The investigation focused on identifying affected repositories, the number of workflow runs executed during the critical 24-hour period, and the types of secrets leaked. Ultimately, only 218 out of over 5,000 repositories leaked secrets, primarily short-lived GitHub install access tokens that expire after a workflow finishes, reducing their value to attackers. Despite the limited scale, the potential damage to individual repositories can be significant, especially if leaked credentials for services like DockerHub or npm are exploited for further supply chain attacks. Users were advised to rotate their secrets and monitor for any malicious activity, and companies like Endor Labs offer tools for CI scanning and dependency analysis to enhance security for GitHub Actions workflows.

Cyber Essentials is a UK government-backed certification scheme aimed at helping organizations protect against common internet-based threats by implementing a practical cybersecurity framework. This certification, set by the UK’s National Cyber Security Centre (NCSC), is not required by law but is often necessary for government contracts, particularly those involving the Ministry of Defense. It includes two levels: Cyber Essentials and Cyber Essentials Plus, focusing on five key areas: firewalls and internet gateways, secure configuration, user access control, malware protection, and security update management. Organizations that achieve this certification can enhance their reputation, win contracts, especially with government agencies, and reassure clients about their cybersecurity standards. The certification process involves maintaining a strong security posture through practices like vulnerability prioritization, managing third-party software dependencies, and ensuring regular security updates across the supply chain. Tools like Endor Labs can aid organizations in achieving and maintaining Cyber Essentials certification by providing visibility, dependency management, vulnerability prioritization, and compliance reporting.

A recent security breach involving the tj-actions/changed-files GitHub Action, used in over 23,000 repositories, has raised significant concerns within the developer community. Attackers introduced a malicious commit that affected multiple version tags, leading to the execution of a Python script capable of leaking CI/CD secrets. This incident, identified as CVE-2025-30066, has impacted public GitHub repositories with GitHub Actions enabled, prompting GitHub to remove the compromised Action and necessitating users to seek alternative implementations. Although GitHub has since restored the repository without the malicious code, the breach has highlighted vulnerabilities in the software supply chain, potentially affecting thousands of open-source packages. Developers and organizations are advised to audit their GitHub logs, search dependencies for the compromised Action, and rotate any exposed secrets to mitigate further risks.

Application Security Posture Management (ASPM) solutions have emerged in response to evolving threats and software development practices, aiming to consolidate, prioritize, and mitigate risks across the application lifecycle. These tools integrate signals from various application security tools like SAST, DAST, and SCA, to improve visibility and manage vulnerabilities without replacing existing systems. While ASPM aggregates and correlates data to reduce alert duplication, it does not inherently enhance data quality, leading to the emergence of new platforms focused on reducing noise at the source. Despite their promise, ASPM solutions often struggle with the quality of alerts due to the underlying issues with scanner data, prompting vendors to introduce built-in scanners or rebrand existing solutions. The ongoing challenge is to integrate these tools effectively into workflows, providing actionable insights to developers and security teams, while a new generation of platforms seeks to address these issues by offering comprehensive, context-rich solutions that go beyond alert aggregation.