--- title: Xygeni GitHub Action Compromised Via Tag Poison | daily.dev description: An unidentified threat actor compromised Xygeni's xygeni/xygeni-action GitHub Action via tag poisoning. After failing to merge malicious code through pull... canonical: https://daily.dev/posts/xygeni-github-action-compromised-via-tag-poison-csdte3qcp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Xygeni GitHub Action Compromised Via Tag Poison | daily.dev og:description: An unidentified threat actor compromised Xygeni's xygeni/xygeni-action GitHub Action via tag poisoning. After failing to merge malicious code through pull... og:url: https://daily.dev/posts/xygeni-github-action-compromised-via-tag-poison-csdte3qcp og:image: https://api.daily.dev/og/posts/cSDTE3QCp.png og:image:alt: Xygeni GitHub Action Compromised Via Tag Poison og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Xygeni GitHub Action Compromised Via Tag Poison **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 1 upvotes · 0 comments ## Summary An unidentified threat actor compromised Xygeni's xygeni/xygeni-action GitHub Action via tag poisoning. After failing to merge malicious code through pull requests (blocked by branch protection rules), the attacker moved the mutable v5 tag to point to a backdoored commit containing a C2 reverse shell. For approximately seven days (March 3–10), any workflow referencing xygeni/xygeni-action@v5 executed the implant, giving attackers access to CI runner secrets, GITHUB_TOKEN, and source code. The root cause was a compromised GitHub App private key with overly broad permissions, combined with a maintainer's personal access token. Xygeni has committed to enforcing release immutability, hardening permissions, requiring signed commits, and restricting write access. StepSecurity and Xygeni dispute some timeline details, particularly around when the v5 tag was poisoned. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials](https://daily.dev/posts/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltr-12ij52s4u) · StepSecurity · 2 upvotes · 0 comments - [GitHub Actions is the weakest link](https://daily.dev/posts/github-actions-is-the-weakest-link-kx8cbboab) · Andrew Nesbitt · 1 upvotes · 0 comments - [Trivy Scanner Compromise Explained and What it Means For Your SaaS and CI/CD Security](https://daily.dev/posts/trivy-scanner-compromise-explained-and-what-it-means-for-your-saas-and-ci-cd-security-mphhq7ti6) · Security Boulevard · 0 upvotes · 0 comments - [Is GitHub Actions Putting Your Software at Risk?](https://daily.dev/posts/is-github-actions-putting-your-software-at-risk--a2b2a1jji) · Atomic Spin · 0 upvotes · 0 comments - [GitHub Actions Cache Poisoning is eating open source](https://daily.dev/posts/github-actions-cache-poisoning-is-eating-open-source-dyhf0mvj0) · Neciu Dan · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/xygeni-github-action-compromised-via-tag-poison-csdte3qcp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Xygeni GitHub Action Compromised Via Tag Poison","url":"https://daily.dev/posts/xygeni-github-action-compromised-via-tag-poison-csdte3qcp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/xygeni-github-action-compromised-via-tag-poison-csdte3qcp"},"datePublished":"2026-03-11T20:39:23.683Z","dateModified":"2026-03-11T20:40:01.930Z","description":"An unidentified threat actor compromised Xygeni's xygeni/xygeni-action GitHub Action via tag poisoning. After failing to merge malicious code through pull...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/27b0e876103bd365d6a71569275fe0d0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/27b0e876103bd365d6a71569275fe0d0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/xygeni-github-action-compromised-via-tag-poison-csdte3qcp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cicd,github-actions,appsec","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Xygeni GitHub Action Compromised Via Tag Poison"}]} ```