Self-hosted GitHub Actions runners can be weaponized as persistent backdoors by attackers. The Shai-Hulud worm (November 2025) demonstrates this at scale: after compromising developer machines via trojanized npm packages, it creates a GitHub repo, registers a rogue runner, and plants an intentionally vulnerable workflow that allows command injection via GitHub Discussions. Key techniques include setting RUNNER_TRACKING_ID=0 to bypass process cleanup, running as root via RUNNER_ALLOW_RUNASROOT=1, and using nohup for persistence. All C2 traffic flows through github.com, bypassing traditional network defenses. Detection strategies include monitoring for the RUNNER_TRACKING_ID=0 env variable (a Falco rule is provided), auditing runner registrations via GitHub API, and watching for runners in hidden directories. Mitigations include never using self-hosted runners with public repos, using ephemeral runners, and restricting runner network access.
