Kaspersky researchers identified over 250,000 potential security issues within GitHub Actions workflows after reviewing top-starred repositories on the platform.
Consequently, the Global Research and Analysis Team analyzed continuous integration and delivery pipelines to detect misconfigurations. As a result of this detailed review, the team discovered eight repositories with critical flaws that could lead to supply chain compromise.
Open-source components remain essential for modern apps & software engineering. However, these components also introduce vectors for supply-chain attacks. For instance, the Mini Shai-Hulud campaign in May 2026 exploited build pipelines. This attack compromised more than 170 npm and PyPI packages, affecting projects like TanStack, Mistral AI, and OpenSearch.
The security firm analyzed more than 130,000 pipelines across 30,000 of the platform’s top starred repositories to evaluate GitHub Actions workflows. Specifically, researchers used specialized scanning rules within their container security solution. The results showed that only 10% of the analyzed repositories triggered no alerts.
Security Risks in GitHub Actions workflows
Among the discovered issues, 59.8% are classified as low-risk, 39.8% as medium-risk, and 0.4% as high-risk. The most frequent issues involve implicitly granted or overly broad access permissions. In addition, missing version pinning for dependencies and workflow-level settings occurred frequently.
Analysis of Repository Vulnerabilities
Fewer repositories expose top-level secrets or use unsafe run conditions. Meanwhile, some process external data insecurely, which potentially leads to severe compromises. The team identified 200 repositories as high-risk during the assessment.
High Risk Findings and Impact
Among the high-risk group, eight repositories contained critical flaws. These affected repositories spanned various use cases, including artificial intelligence integration in enterprise environments. Other affected areas included developer services, automation services, and security testing tools. The researchers reported these critical issues to the respective developers.
Recommendations for Pipeline Security
Leonid Bezvershenko, senior security researcher at Kaspersky, stated that serious supply-chain attacks could be prevented by following secure configuration guidelines. He noted that the uncovered issues do not automatically indicate exploitable vulnerabilities. However, they point to areas where developers should verify and strengthen configurations.
Organizations can build more resilient pipelines by identifying these weaknesses early in their GitHub Actions workflows. To mitigate these potential security issues, users can use repository scanning. This scanning can be embedded directly into pipelines or operated in standalone mode.
