# Node.js Test CI Security Incident

DevFeed: [Node.js Test CI Security Incident](<https://devfeed.tech/articles/node-js-test-ci-security-incident-2894.md>)

Original publisher: [Read original article](<https://nodejs.org/en/blog/vulnerability/march-2025-ci-incident>)

Published: 2025-04-23T16:30:00Z

Content type: article

Language: en

Sources: [Node.js Blog](<https://devfeed.tech/sources/node-js-blog.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Jenkins](<https://devfeed.tech/topics/jenkins.md>), [Security](<https://devfeed.tech/topics/security.md>), [Git](<https://devfeed.tech/topics/git.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [ci](<https://devfeed.tech/tags/ci.md>), [git](<https://devfeed.tech/tags/git.md>), [github](<https://devfeed.tech/tags/github.md>), [incident](<https://devfeed.tech/tags/incident.md>), [jenkins](<https://devfeed.tech/tags/jenkins.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Node.js reported a successful compromise of several test CI hosts after an attacker used a pull request and an outdated Git commit timestamp to cause Jenkins pipelines to execute altered fork code. The incident exposed a Time-of-Check-Time-of-Use vulnerability involving mutable Git references. The team restricted CI runs, rebuilt 24 compromised hosts, enforced commit SHA validation, audited 140 Jenkins jobs, and patched vulnerable GitHub workflows.

## Source excerpt

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.