8,000 Strong: Harden-Runner's Growing Impact on CI/CD Security

StepSecurity’s Harden-Runner now protects more than 8,000 open-source repositories with EDR-style runtime monitoring for CI/CD pipelines, aiming to stop supply chain attacks and secure GitHub Actions. It monitors over 8 million jobs weekly, spanning workflows from individual developers to Fortune 500 companies, emphasising that securing CI/CD infrastructure has become an absolute necessity.

The platform’s capabilities were highlighted at Black Hat USA 2025, where Harden-Runner was described as detecting the tj-actions supply chain breach that affected over 23,000 repositories including those from GitHub, Meta, and Microsoft. The article also notes a recent surge in npm package compromises, with incidents in September 2025 and August 2025, and a July 2025 attack on the is-package, illustrating the ongoing threat landscape to JavaScript ecosystems.

Two detections demonstrated the value of runtime monitoring: unexpected Microsoft Defender installation on GitHub-hosted Ubuntu runners from July 15, 2025, and suspicious tag movement in AWS’s configure-aws-credentials action in August 2025, both of which were flagged in real time. The piece argues that teams favour runtime protection that requires no workflow rewrites and supports security without sacrificing productivity.