GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk

GitHub has added cache-mode to GitHub Actions, a new setting that limits how workflows and jobs can access the Actions cache. It targets cache poisoning, the technique attackers used to compromise the Ultralytics PyPI package in 2024 and the TanStack npm packages in May 2026. Cache poisoning works because an entry written to the shared Actions cache in one context can be restored and run in another.

An attacker who gains write access to a cache key that a trusted workflow later reads can plant malicious build artifacts or dependencies that execute with that workflow's permissions and secrets. In the TanStack attack, chained with a pull_request_target pwn request, the attacker published 84 malicious versions across 42 @tanstack/* packages. Build provenance does not catch a poisoned cache.