# Retired namespace re-registration hijack

References to renamed or deleted owners, orgs, or packages whose old names are free to re-register

_Area: Software supply chain and CI/CD. Seen in 3 disclosed reports; one confirmed bounty: $4,000; latest 2022-12-04. Updated 2026-10-23._

## How it works
A reference (workflow `uses:`, repo link, package name) points at an owner or name that once existed but was renamed or deleted. The platform keeps a redirect or reservation so old references still resolve. The assumption that breaks: that the old name stays reserved forever. When the reservation lapses or a creation path skips the central check, anyone can claim the freed name and inherit every reference pointing at it. The reference now resolves to attacker-controlled content with no change to the victim's files.

## Where it shows up
- `uses:` entries pointing at third-party orgs/repos that redirect to a different current name [E2](https://bugbountylibrary.com/r/h1%3A1439355.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md)
- References to owners that no longer resolve to the original account (renamed, deleted, restored) [E1](https://bugbountylibrary.com/r/blog%3Ablog-nietaanraken-nl-posts-gitub-popular-repository-namespace-retirement-bypass.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md)
- Restore, transfer, rename, or fork paths that re-derive the owner from the *current* account name rather than the name at deletion time [E1](https://bugbountylibrary.com/r/blog%3Ablog-nietaanraken-nl-posts-gitub-popular-repository-namespace-retirement-bypass.md)
- Unpinned action references (tag/branch instead of commit SHA) [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md)
- Workflows running with secrets or `GITHUB_TOKEN` while calling external actions [E2](https://bugbountylibrary.com/r/h1%3A1439355.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md)

## How to review
The invariant: every external reference must resolve to an owner/name that is still owned by the intended party and cannot be re-registered by anyone else. Check each `uses:` owner: does it redirect to a different login? If so, the original name is reclaimable and the reference is hijackable [E2](https://bugbountylibrary.com/r/h1%3A1439355.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md). For platform features, verify that restore/transfer/rename re-check the retired-name reservation against the deletion-time name, not the current one [E1](https://bugbountylibrary.com/r/blog%3Ablog-nietaanraken-nl-posts-gitub-popular-repository-namespace-retirement-bypass.md). Pin third-party actions to commit SHAs so a repointed name cannot change what runs [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md).

## Variants seen
- Repo restore re-deriving owner from current username, bypassing namespace retirement [E1](https://bugbountylibrary.com/r/blog%3Ablog-nietaanraken-nl-posts-gitub-popular-repository-namespace-retirement-bypass.md)
- Dangling org name in a base action after the org renamed, reclaimed to run code with victim secrets [E2](https://bugbountylibrary.com/r/h1%3A1439355.md)
- Mass repo-redirect hijack of `uses:` references to steal `GITHUB_TOKEN` [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md)

## Impact and severity
Led to running attacker code inside victim CI with access to secrets and tokens [E2](https://bugbountylibrary.com/r/h1%3A1439355.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md), and to repository namespace takeover [E1](https://bugbountylibrary.com/r/blog%3Ablog-nietaanraken-nl-posts-gitub-popular-repository-namespace-retirement-bypass.md). Severity is high where workflows hold deploy credentials or write tokens. Worse when references are unpinned and redirects silently mask the change, so nothing in the repo looks wrong [E3](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-nietaanraken-nl-posts-gitub-popular-repository-namespace-retirement-bypass.md
- E2: https://bugbountylibrary.com/r/h1%3A1439355.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-github-actions-supplychain.md