Xygeni

Profile narrative

Xygeni, also known by its alias Xygeni, is headquartered in Israel. The organization maintains and distributes a GitHub Action named xygeni/oxygeni-action, which is integrated into continuous integration and continuous delivery pipelines used by software development teams. This action provides automation capabilities that allow users to execute custom workflows directly within their GitHub repositories. By offering this tool, Xygeni participates in the broader ecosystem of DevOps and software supply‑chain solutions. The company’s primary visibility in public sources stems from its stewardship of this specific GitHub Action.

On March 3, 2026, Xygeni disclosed that threat actors had compromised the xygeni/oxygeni-action GitHub Action. The attackers obtained a GitHub App private key and a maintainer’s personal access token, which they used to push malicious code through a series of pull requests. After gaining write access, they altered the v5 tag of the repository so that it pointed to a backdoored commit rather than the legitimate release. This tag poisoning meant that any workflow referencing xygeni/oxygeni-action@v5 would retrieve the compromised version of the action. The malicious version contained a command‑and‑control implant designed to execute arbitrary instructions on runner environments. The implant remained active for several days, during which time dependent workflows could unknowingly download and run the harmful code. Xygeni subsequently removed the poisoned tag and closed the malicious pull requests to halt further distribution.

Investigation of the incident revealed no evidence that the main branch of the repository had been altered or that customer data had been accessed or exfiltrated. The compromise was confined to the tagged release and the associated workflows that consumed it. The details of the breach were reported by DarkReading, which cited the organization’s own statement and technical analysis. Xygeni’s headquarters in Israel remains unchanged, and the organization continues to maintain its GitHub Action offerings following the remediation. The episode highlights the risks associated with supply‑chain attacks on widely used automation tools and underscores the importance of securing credentials and release metadata.

Incidents

1 incident linked to this organisation.