Supply chain risk monitor

The most-used GitHub Actions,
ranked by supply chain risk

Unlike npm and PyPI, GitHub Actions tags are mutable. A maintainer — or an attacker with their credentials — can silently replace what v3 points to. Every workflow using tag-based references is one compromised account away from leaking every secret in the pipeline.

Curated risk assessment · 25 actions · Updated April 2026

Real incident: tj-actions/changed-files (March 2025)
Attackers compromised a maintainer token via a cascading supply chain attack through reviewdog/action-setup. The malicious commit replaced the action's tag, dumping CI/CD secrets to workflow logs. 23,000 repos used the action; 218 repos had secrets exposed including AWS keys, DockerHub credentials, and npm tokens. The attack lasted ~22 hours before detection.
npm PyPI GitHub Actions
— CRITICAL actions
— Repos depending on CRITICAL
— Solo-maintainer actions
— Actions with write access
Why Actions are different from packages
npm / PyPI GitHub Actions
Version immutability Immutable (once published, can't change) Mutable (tags can be silently replaced)
Execution context Runs in your app's sandbox Runs in CI with secrets, tokens, deploy keys
Attack surface Code injection at build/runtime Direct access to GITHUB_TOKEN + all workflow secrets
Mitigation Lockfiles pin exact versions SHA pinning available but rarely used
# Action Risk Score Repos using Owner Permissions
# How to pin GitHub Actions to commit SHAs

# Mutable tag (UNSAFE - can be silently replaced):
- uses: actions/checkout@v4 MUTABLE

# Immutable SHA pin (SAFE - points to exact commit):
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 IMMUTABLE

# Tools: github.com/mheap/pin-github-action, StepSecurity Harden-Runner

Why this list exists

Most supply chain monitoring focuses on packages. But the CI/CD pipeline is often the highest-privilege environment in the entire software lifecycle — it has deploy keys, cloud credentials, and signing keys. A compromised Action is not a dependency risk. It is a credential exfiltration risk.

How we score Actions

Trust score combines owner trust (GitHub official vs solo dev), permissions scope (read-only vs secrets access), adoption scale (blast radius if compromised), and incident history. Actions run by solo developers with write permissions and massive usage are the highest-value targets.

Pin everything

Replace uses: org/action@v4 with uses: org/action@SHA # v4.x.x. Tools like pin-github-action automate this. It takes 5 minutes to pin every Action in your workflows. After the tj-actions incident, there is no excuse.

Audit your dependencies View npm watchlist View PyPI watchlist