🚨 Runner-Guard Security Finding
Rule: RGS-018 — Suspicious Payload Execution Pattern
Severity: High
File: .github/workflows/daily-squid-image-scan.lock.yml
Line: 1696
Description
A workflow run: block contains code patterns associated with obfuscated payload execution or known indicators of compromise (IOCs) from active supply chain attack campaigns. This includes eval+decode chains (e.g. eval(base64.b64decode(...)), base64 --decode | bash), known malware marker variables, persistence file paths, and C2 communication patterns. These patterns are loaded from Runner Guard's threat signature database. A match against a known IOC indicates active compromise; a match against a dangerous execution pattern indicates susceptibility to this class of supply chain attack.
Impact
If the flagged pattern were reachable by attacker-controlled input, it could enable arbitrary payload execution on the runner with access to repository secrets and write permissions. In generated .lock.yml files this is most often a false positive matching legitimate base64/decode helper logic emitted by the compiler — but because line 1696 has no prior triage record, it should be reviewed to confirm the matched snippet is compiler-generated boilerplate and not an injected payload.
Remediation
- Inspect
.github/workflows/daily-squid-image-scan.lock.yml at line 1696 and identify the exact command matched.
- Confirm the snippet originates from the gh-aw compiler templates (not hand-authored or externally injected).
- If it is legitimate generated code, suppress at the source template so the pattern is not emitted, or record a documented allowlist entry for RGS-018 in this file.
- If the pattern is unexpected, treat as a potential supply-chain compromise and rotate any exposed credentials.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/29982756775
Generated by 📊 Static Analysis Report · age00 200.8 AIC · ⌖ 31 AIC · ⊞ 10K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-018 — Suspicious Payload Execution Pattern
Severity: High
File:
.github/workflows/daily-squid-image-scan.lock.ymlLine: 1696
Description
A workflow
run:block contains code patterns associated with obfuscated payload execution or known indicators of compromise (IOCs) from active supply chain attack campaigns. This includes eval+decode chains (e.g.eval(base64.b64decode(...)),base64 --decode | bash), known malware marker variables, persistence file paths, and C2 communication patterns. These patterns are loaded from Runner Guard's threat signature database. A match against a known IOC indicates active compromise; a match against a dangerous execution pattern indicates susceptibility to this class of supply chain attack.Impact
If the flagged pattern were reachable by attacker-controlled input, it could enable arbitrary payload execution on the runner with access to repository secrets and write permissions. In generated
.lock.ymlfiles this is most often a false positive matching legitimate base64/decode helper logic emitted by the compiler — but because line 1696 has no prior triage record, it should be reviewed to confirm the matched snippet is compiler-generated boilerplate and not an injected payload.Remediation
.github/workflows/daily-squid-image-scan.lock.ymlat line 1696 and identify the exact command matched.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/29982756775