GitHub Actions is a free CI/CD service, and it’s now being abused to mine cryptocurrency. I introduce what GitHub Actions is in another post, so I won’t repeat it here — see First look at GitHub Actions Workflows.
To be clear up front: abusing GitHub Actions Workflows to mine cryptocurrency is deeply unethical. It eats shared public resources, and I have nothing but contempt for people who do it. Don’t try it — GitHub currently bans accounts the moment it spots this, and by that I mean the entire account. Seriously, don’t.
What Happened
This abuse was first spotted back in November 2020, but there’s still no good remedy. GitHub can only ban accounts one at a time; mining can’t be blocked in bulk yet.
How the Mining Works
Step one: pick an ordinary GitHub repository — even an official one — as long as it has GitHub Actions Workflows enabled with CI/CD configured on pull requests. Most projects set that up, using continuous integration to keep the code correct, run unit tests, or track coverage.
Step two: fork it into your own repository, at which point you’re free to modify the code. Drop in your mining program — say, execute an npm.exe — and it runs whenever GitHub Actions Workflows is triggered.
Step three: open a pull request against the original repository. That triggers CI/CD, which runs GitHub Actions Workflows, which runs the miner you planted. It’s fully automatic: the malicious pull request doesn’t need the upstream maintainer’s approval to get executed.
The Impact
First, this attack doesn’t compromise the developer’s repository. It exploits the repository’s GitHub Actions feature to plant a miner on GitHub’s servers — freeloading. GitHub provides us server resources for free, and this burns a huge chunk of those shared resources running mining software.
GitHub has opened an investigation but still has no good fix beyond banning accounts one by one. Many malicious programs disguise themselves as legitimate ones — the miner embedded here is literally named npm.exe, which is not Node.js’s npm package manager at all, but a miner through and through.