# xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning

Stolen maintainer credentials let an attacker move the mutable v5 tag of xygeni-action to a commit with a C2 reverse-shell backdoor, silently compromising all @v5 consumers.

- Payout: Real-world hack
- Severity: critical
- Program: Xygeni
- Analysis by: StepSecurity
- Disclosed: 2026-03-26
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/xygeni-action-compromised-c2-reverse-shell-backdoor-injected-via-tag-poisoning
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-xygeni-action-compromised-c2-reverse-shell-backdoor-injected-via-tag-poisoning
- Tags: area:cloud domain:infra impact:data-leak impact:rce kind:incident platform:threat-intel sev:critical tech:github-actions technique:recon technique:source-review vuln:secrets-leak

**Target:** GitHub Action (xygeni/xygeni-action) CI/CD workflow
**Root cause:** Mutable lightweight tag v5 was force-pushed to a backdoored commit on an unmerged branch, so consumers referencing @v5 ran attacker code without any workflow change. Attacker used stolen maintainer/GitHub App credentials to push the malicious commit.
**Steps:**
1. Attacker with stolen maintainer creds pushes commit adding a 'Report Scanner Telemetry' step to action.yml containing an obfuscated bash C2 implant
2. Open PRs #46/#47/#48 (closed unmerged) to seed the commit on branches
3. Force-push mutable tag `v5` to backdoored commit `4bf1d4e`
4. Any workflow using `uses: xygeni/xygeni-action@v5` now executes the implant
5. Implant POSTs hostname/user/OS to `https://security-verify.91.214.78.178.nip.io/b/in`, polls `/b/q?b=<id>` every 2-7s for 180s, evals commands, POSTs zlib+base64 output to `/b/r`
**How found:** StepSecurity threat intel observed the rapid sequence of three identical-payload PRs from three different Xygeni identities within 23 minutes, then traced the v5 tag pointing to an unmerged commit (imposter commit) and analyzed the obfuscated action.yml step.
**Exploitation:** Precondition: victim workflow references @v5. On run, backgrounded step registers with C2, receives arbitrary shell commands via eval, and exfiltrates compressed base64 output. Attacker gains code execution on the CI runner for 3 minutes, enabling theft of GITHUB_TOKEN, XYGENI_TOKEN, secrets, source code, and artifact tampering while the legitimate scan proceeds normally.
**Escalation:** Runner RCE enables secret exfiltration and pivot to other systems reachable from the runner; affects every repo referencing @v5 simultaneously (mass supply-chain compromise).
**Insight:** Watch for tags pointing at commits not on any branch (imposter commits) and for rapid open/close PR cycles from multiple identities with identical payloads; mutable major-version tags are the silent delivery vector even when PRs are rejected.