GitHub disables two compromised Actions after renewed exposure

Two compromised third-party GitHub Actions were disabled again on September 25 after their release tags had pointed to malicious code for more than a week, BleepingComputer reported, citing Socket researchers. The actions became accessible on September 16 without their old payload being removed, so workflows using those tags could download and run it. The malware targets developer tokens, credentials and automation secrets. GitHub's dependency graph lists about 15,000 repositories depending on one of the actions, but that figure does not show how many ran a compromised tag. Workflows referencing the disabled actions now fail instead of running the payload.