Xygeni

Summary

Xygeni reported that threat actors compromised its xygeni/oxygeni-action GitHub Action by exploiting a GitHub App private key and a maintainer's personal access token to push malicious code via pull requests and then poison the v5 tag to point to a backdoored commit. The poisoned tag allowed workflows referencing xygeni/oxygeni-action@v5 to download a command‑and‑control implant for several days before the tag was removed and the malicious pull requests were closed, with no evidence that the main branch or customer data were affected.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 3, 2026, an attacker who had obtained a maintainer's personal access token and a GitHub App private key with broad permissions created a malicious commit containing a compact command-and-control implant in the xygeni/xygeni-action repository. The attacker opened three pull requests that introduced the malicious code, but existing branch protection rules prevented the requests from being merged into the main branch. After the pull requests were closed, the attacker moved the mutable v5 tag to point at the commit containing the implant, a change that was not recorded in GitHub's repository activity log. Workflows that referenced xygeni/xygeni-action@v5 began retrieving the compromised code without any visible alteration to the workflow definitions, allowing the implant to execute in continuous integration environments. The implant was disguised as a 'scanner version telemetry' step and operated as a reverse shell that communicated with an external command-and-control server.

Xygeni became aware of suspicious activity on March 9, 2026, after community reports and a blog post from StepSecurity highlighted the issue, and the vendor confirmed that the v5 tag had been poisoned sometime after the malicious commit was created and before the discovery date. The vendor removed the poisoned v5 tag, closed the three pull requests, and deleted any associated workflows from the repository as part of its incident response. Investigation showed that no malicious code was merged into the repository's main branch and there was no evidence of compromise to Xygeni's platform or customer data. The root cause was identified as the compromise of a GitHub App private key that had been installed on the repository with unnecessarily broad permissions, which the attacker used in conjunction with a maintainer's personal access token to create and approve the pull requests. The exact method by which the private key was exfiltrated remains under investigation, though such keys can be exposed through misconfigured workflows, compromised developer machines, or insecure secret storage.

Sources

Sources available to members: 1 source.