CI/CD news and engineering summaries

Attackers hijacked an axios maintainer's npm account to publish malicious versions (1.14.1, 0.30.4) that install a hidden dependency, plain-crypto-js. This payload executes a cross-platform RAT dropper, contacts a C2 server, and self-cleans to evade detection. Compromised users are urged to rotate credentials immediately and downgrade to secure versions (1.14.0 or 0.30.3).

On May 11, 2026, TanStack suffered a supply chain attack where 84 malicious package versions were published. Attackers chained GitHub Actions cache poisoning, pull_request_target misuse, and OIDC token theft to bypass CI/CD security. No npm credentials were stolen, but local installations may be compromised. All affected versions were deprecated, and security hardening is underway.

Filippo Valsorda argues against using Dependabot due to excessive false positives, particularly in the Go ecosystem. He recommends replacing it with govulncheck and scheduled GitHub Actions. This approach utilizes reachability analysis to filter irrelevant security alerts and suggests testing against latest dependencies in CI without immediate, noisy version bumps.

A coordinated supply chain attack compromised over 170 npm packages and 2 PyPI packages, totaling 404 malicious versions. Notable targets included TanStack, Mistral AI, UiPath, and OpenSearch. The malware exfiltrates cloud and CI/CD credentials via the Session protocol and uses IDE-poisoning techniques to ensure self-propagation through malicious commits, marking a major escalation in cross-ecosystem registry poisoning.

Migrating repositories from GitHub to Codeberg is simplified by built-in import tools and the familiarity of Forgejo Actions. Users can replicate GitHub workflows, use codeberg.page for hosting, and handle CI transitions by self-hosting runners. The process involves archiving old repositories and managing mirrors to maintain a smooth transition for existing contributors.

The author, a veteran of numerous CI systems, argues that GitHub Actions creates significant operational friction for engineering teams. Issues include a slow, unstable log viewer, complex and limiting YAML syntax, opaque marketplace dependencies, and inadequate compute control. The author recommends Buildkite for its superior logs, better compute ownership, and cleaner pipeline architecture.

Obsidian has launched a new Community portal and developer dashboard to streamline plugin and theme management. The initiative introduces automated security and code quality reviews, real-time status tracking, and project scorecards. These updates aim to improve ecosystem safety and scalability while enabling faster submission processes and enhanced discovery tools for the platform's 120 million-plus downloads.

A developer blamed a Cursor/Claude agent for deleting their production database, highlighting a lack of accountability. The author argues that human error and poor architecture—specifically exposing dangerous API endpoints—are the root causes. True security requires robust automated processes and human oversight rather than blindly relying on AI to perform critical tasks.

In this article, the author expresses a profound frustration with GitHub Actions, detailing an experience with a broken feedback loop during a project build. While developing a tool called tmplr, the author encountered persistent failures on a Linux ARM runner that were difficult to debug locally. The narrative highlights the inefficiency of the 'edit-push-wait' cycle, which often takes several minutes for a single YAML change, comparing it to the slow era of loading programs from cassette tapes. To resolve the issue, the author advocate for keeping CI logic within local scripts or Makefiles rather than embedding it directly into the GitHub Actions configuration. Despite the disdain for the platform's debugging process, the author acknowledges its necessity for providing environments like macOS runners that are otherwise hard to access, concluding that developers are essentially 'doomed' to use it.

Astral details its rigorous security strategy for open-source tools like Ruff and uv. The approach focuses on hardening GitHub Actions via hash-pinning, permission reduction, and trigger restrictions, while leveraging Trusted Publishing, Sigstore attestations, and dependency management to secure the software supply chain. Their model promotes isolation, multi-party approvals, and proactive risk mitigation.

Local-first CI advocates for running build and test scripts locally before pushing to remote servers like GitHub Actions. This approach shortens feedback loops, minimizes context switching, and ensures reproducibility. By using tools like Nix to synchronize environments, developers can catch errors faster and avoid vendor lock-in associated with platform-specific CI configurations.

On March 31, 2026, compromised versions of axios (1.14.1 and 0.30.4) were published to npm via a hijacked maintainer account. The attacker injected a malicious dependency, plain-crypto-js, which executes an obfuscated postinstall payload. This script downloads platform-specific RATs for Windows, macOS, and Linux, bypassing standard CI/CD and SLSA provenance checks. Users should pin axios to safe versions and rotate credentials.

The article explores the fundamental purpose of Continuous Integration (CI), arguing that its primary value lies in its failure rather than its success. When CI passes, it provides no functional difference compared to a deployment without CI; however, when it fails, it acts as a critical safety net that catches mistakes before they reach production. By shortening the feedback loop and providing automated checks, CI prevents the costly manual rollbacks required when errors are discovered by users. The author also addresses the problem of flaky tests, which undermine this value by making failures unreliable indicators of bug presence. Ultimately, the piece proposes reframing CI 'failures' as positive, valuable outcomes while distinguishing them from technical flakiness.

Open source registries like Maven Central are planning a tiered payment system to address the 'tragedy of the commons.' With 82% of downloads coming from 1% of IPs, massive corporations are abusing repositories as free CDNs. The new model aims to charge high-volume commercial users while keeping access free for individual developers and small projects.

A startup testing Blacksmith, a GitHub Actions alternative, discovered they were invoiced over $1,000 for usage exceeding their free trial. Unlike standard SaaS models that implement hard usage caps, Blacksmith continued service, creating unexpected debt. While the billing policy was surprising, the company opted to remain with Blacksmith due to superior performance compared to GitHub Actions.

The article provides a critical evaluation of GitHub Actions, arguing that its market dominance is due to repository integration rather than technical excellence. The author, an experienced engineer, highlights several pain points: a slow and unstable log viewer that frequently crashes browsers, a convoluted YAML-based expression language that is difficult to debug, and security risks inherent in the GitHub Actions Marketplace. Furthermore, the piece criticizes the performance of standard runners and the complexity of managing permissions and caching. As an alternative, the author suggests Buildkite for production environments, praising its superior log handling, dynamic pipelines, and the ability to run agents on private infrastructure. While GitHub Actions remains suitable for small projects or open-source libraries, the author contends that serious engineering teams should prioritize tools that offer better performance and developer experience to avoid productivity loss.

The image displays a GitHub action workflow configuration file, specifically defining a CI/CD pipeline. It details steps such as checking out the repository, setting up Python, installing dependencies via pip, and executing tests, showing how developers automate software testing and deployment workflows.

GitHub experienced service degradation on April 20-21, 2026, affecting code scanning, code quality analyses, and project boards due to a serialization error. The issue prevented triggers for pull requests and updates on project boards. GitHub mitigated the incident by deploying fixes, updating event consumers, and reindexing project items, while planning improved monitoring and schema validations.

A service outage affecting GitHub Actions, Copilot, and Webhooks has been successfully resolved. Engineers identified the root cause and implemented mitigation steps to restore full system stability. A detailed analysis of the incident will be provided in a follow-up report.

Starting June 1, 2026, GitHub Copilot code reviews on private repositories will consume GitHub Actions minutes. This update introduces a new billing model leveraging both AI Credits and standard Actions minutes. Developers are encouraged to monitor usage and adjust budget settings to prepare for this transition, while features for public repositories remain unchanged.