# chainguard actions Published articles for chainguard actions. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Introducing the Guardener GitHub App DevFeed: [Introducing the Guardener GitHub App]() Original publisher: [Read original article]() Published: 2026-08-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard actions](), [GitHub](), [CI/CD](), [migration](), [Security](), [Open Source]() Tags: [chainguard](), [chainguard-actions](), [ci-cd](), [github](), [migration](), [open-source](), [pull-request](), [security](), [yaml]() ### AI overview Chainguard introduces the Guardener GitHub app in beta to automate migration from GitHub Actions to secure-by-default Chainguard Actions. The app helps teams inventory actions across repositories and open migration pull requests for actions with Chainguard equivalents, improving CI/CD security with less developer friction. ### Source excerpt Meet the Guardener GitHub app, built to automate migration to hardened Chainguard Actions and help teams secure CI/CD without slowing developers. ## Secure your pipelines with Chainguard Actions, now available in Open Beta DevFeed: [Secure your pipelines with Chainguard Actions, now available in Open Beta]() Original publisher: [Read original article]() Published: 2026-06-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard actions](), [GitHub Actions](), [CI/CD](), [Security]() Tags: [chainguard-actions](), [chainguard-ci-cd](), [ci-cd](), [github-actions](), [release](), [secure-ci-cd-actions](), [secure-github-actions](), [security](), [supply-chain](), [vulnerability]() ### AI overview Chainguard Actions has entered Open Beta, offering teams self-serve access to a catalog of hardened, verified GitHub Actions. The release also supports requests for new Actions and automated migration to reduce CI/CD supply chain risk. ### Source excerpt Chainguard Actions enters Open Beta with 500+ hardened GitHub Actions, one-day request SLAs, and automated migration for safer CI/CD. ## Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp DevFeed: [Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp]() Original publisher: [Read original article]() Published: 2026-06-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm packages](), [Malware](), [Security](), [CI/CD](), [npm](), [chainguard libraries](), [chainguard]() Tags: [chainguard](), [chainguard-actions](), [chainguard-containers](), [chainguard-libraries](), [ci-cd](), [malware](), [miasma](), [npm-security](), [packages](), [phantom-gyp](), [shai-hulud](), [supply-chain]() ### AI overview This article describes the Miasma Phantom Gyp npm supply-chain attack, in which attackers published 286 malicious versions across 57 packages. The self-replicating worm targeted CI/CD pipelines, harvested credentials, poisoned additional packages, modified workflows, and planted backdoor configurations in AI coding assistant directories. It also explains that Chainguard customers were protected because Chainguard Libraries builds from source and blocked the malicious versions. ### Source excerpt A new npm supply chain worm compromised 57 packages and 286 versions. Learn how Chainguard blocked the attack and protected customers by design. ## Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads DevFeed: [Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads]() Original publisher: [Read original article]() Published: 2026-06-01T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Security](), [GitHub Actions](), [npm packages](), [GitHub](), [obfuscation](), [payload](), [OpenID connect (OIDC)]() Tags: [chainguard-actions](), [chainguard-libraries](), [endpoint-security](), [github](), [github-actions](), [malware](), [mini-shai-hulud](), [npm](), [obfuscation](), [oidc](), [packages](), [payload](), [red-hat](), [redhat-cloud-services](), [security](), [shai-hulud](), [tokens]() ### AI overview The article reports that the Mini Shai-Hulud worm compromised more than 90 @redhat-cloud-services npm packages through a hijacked GitHub account and GitHub Actions OIDC trusted publishing. The worm spreads tampered packages and malicious workflows, executes an obfuscated payload during installation, and steals cloud, Vault, GitHub, npm, and CI credentials. Chainguard customers using Chainguard Libraries for JavaScript and Chainguard Actions were unaffected. ### Source excerpt A new npm worm hit 90+ Red Hat packages. Chainguard customers stayed protected by blocking install-time scripts and hardening CI/CD workflows. ## Malicious axios versions published to npm: Chainguard customers protected DevFeed: [Malicious axios versions published to npm: Chainguard customers protected]() Original publisher: [Read original article]() Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [axios](), [npm](), [Remote Access Trojan](), [Open Source](), [JavaScript](), [payload](), [Single-page application (SPA)](), [Filesystems](), [HTTP](), [Script](), [Linux](), [macOS]() Tags: [axios](), [axios-attack](), [axios-npm-attack](), [axios-supply-chain-attack](), [c2](), [chainguard-actions](), [chainguard-axios](), [chainguard-libraries](), [chainguard-npm-libraries](), [dependency](), [files](), [http](), [javascript](), [linux](), [macos](), [npm](), [npm-packages](), [payload](), [remote-access-trojan](), [script](), [supply-chain-attacks](), [windows]() ### AI overview The article reports that two malicious axios versions were published to npm with a hidden dependency that deployed a cross-platform remote access trojan on macOS, Windows, and Linux. It explains the compromised maintainer account, post-install execution, command-and-control communication, payload delivery, and recommended auditing and remediation steps. Chainguard customers were protected by package-blocking and source-verification controls. ### Source excerpt Malicious axios versions on npm delivered a RAT via a hidden dependency. Chainguard customers were protected by blocking unsafe packages and verifying source. ## Introducing Chainguard Actions: CI/CD workflows you can trust DevFeed: [Introducing Chainguard Actions: CI/CD workflows you can trust]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard actions](), [CI/CD](), [GitHub Actions](), [supply-chain-security](), [Security](), [AI-assisted coding]() Tags: [ai-coding-agents](), [chainguard](), [chainguard-actions](), [chainguard-for-github](), [ci-cd](), [ci-cd-workflows](), [coding-agents](), [github](), [github-actions](), [secure-ci-cd-workflows](), [secure-github-actions](), [security](), [software-supply-chain]() ### AI overview Chainguard introduces Chainguard Actions, a securely rebuilt and continuously maintained catalog of GitHub Actions and similar CI/CD workflows. The service aims to provide secure-by-default automation for privileged software delivery pipelines, reducing risks from unaudited third-party workflows, secret exposure, unsafe shell expressions, and insecure input handling. ### Source excerpt Chainguard Actions is a securely rebuilt catalog of GitHub Actions and similar CI/CD workflows built and continuously maintained in the Chainguard Factory. ## Everything we announced at Chainguard Assemble 2026 DevFeed: [Everything we announced at Chainguard Assemble 2026]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Security](), [Cloud Native Ecosystem](), [Containers](), [CI/CD](), [Development](), [Open Source](), [ai-coding](), [bazel](), [Docker](), [Dockerfile]() Tags: [2026](), [ai](), [ai-agent-skills](), [ai-coding](), [bazel](), [built-from-source](), [chainguard](), [chainguard-actions](), [chainguard-agent-skills](), [chainguard-assemble](), [chainguard-catalog](), [chainguard-catalog-starter](), [chainguard-commercial-builds](), [chainguard-containers](), [chainguard-os-packages](), [chainguard-repository](), [chainguard-the-guardener](), [ci-cd](), [cve](), [tooling]() ### AI overview Chainguard Assemble 2026 presented Chainguard's response to faster AI-assisted software development and the resulting growth in open source software and security risks. Announcements included Chainguard OS Packages, Chainguard Catalog Starter, and expanded support for secure software development, CI/CD workflows, container images, and AI agent skills. ### Source excerpt Catch up on all the announcements Chainguard made at Assemble 2026, featuring AI agent skills, CI/CD workflows, and more.