Harden Runner

Reported Context (6)

appear in every CI/CD environment’s default allowlist. The only network-layer defense that works is Harden Runner’s step-level egress lockdown, which blocks unexpected api.github.com API calls during install steps Step Security Reports Shai-Hulud Worm in Hijacked Intercom npm Package, Targeting Cloud Credentials
StepSecurity's Harden Runner blocked the outbound connection to audit.checkmarx.cx during a controlled test run, stopping exfiltration at the network layer. The AI Package Analyst flagged the anomalous preinstall hook Malicious Bitwarden CLI npm Release Targets Developer Credentials and GitHub Actions
identifying credential theft, env exfiltration, browser password theft, and network exfiltration; and Harden Runner, which captured the malware's exfil connections during a controlled analysis run. Malicious pgserve npm Releases Harvest Credentials and Spread to Other Packages
analysis findings, we ran both compromised versions in a controlled GitHub Actions environment with Harden Runner enabled in audit mode — one Ubuntu job and one Windows job. The run confirms the malware fires StepSecurity Details TeamPCP Credential Stealer in Malicious Telnyx PyPI Releases
findings, StepSecurity ran the malicious package in a controlled GitHub Actions environment with Harden Runner enabled in audit mode. The execution confirmed every stage of the attack chain — and revealed why the LiteLLM PyPI Releases 1.82.7 and 1.82.8 Contain Credential-Stealing Malware

Malware (1)

Threat Actors (1)

MITRE ATT&CK (36)

Vendors (11)

Products (23)

Tools (5)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.