hard20 pts · first answer countsci-cddevsecopssupply-chain-security

Risky GitHub Actions trigger

A public repo has this workflow. Why is it dangerous?

on: pull_request_target
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - run: npm ci && npm test
        env:
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

A.pull_request_target does not run on forks, so tests never run.B.actions/checkout@v4 is deprecated and cannot check out a SHA.C.npm ci is not allowed in GitHub Actions.D.pull_request_target runs with the base repo secrets and write token, and this job checks out and runs untrusted code from the fork, so an attacker can steal NPM_TOKEN or push changes.

← Errors during every rollout Throttled at 30 percent CPU →